Teams
Overview
Teams (also called groups) are Grafana teams used to organise users and assign shared RBAC policies. Users can be added to teams manually or automatically through SSO OAuth group synchronisation.
OAuth Group Synchronisation
When EnableOAuthGroupSync is enabled, the platform syncs a user’s team membership on every login based on the groups carried in their OAuth/SSO token.
-
If a group from the OAuth token matches an existing team by name, the user is added to that team — no new team is created.
-
If the group does not match any existing team, a new team is created automatically and the user is added to it.
-
Users added via OAuth sync are always assigned the Member role within the team.
When RemoveFromNonOAuthGroups is also enabled, the user is removed from any team that is not present in their current OAuth group claims on that login.
Team Member Roles
Grafana teams support two permission levels for members:
| Permission Code | Role | Description |
|---|---|---|
|
Member |
Default role. Assigned to all users added via OAuth sync or when no explicit role is specified. |
|
Admin |
Must be explicitly assigned via the API. Grafana always adds users as Member first; a second API call is required to upgrade to Admin. |
When adding a user via the API with an Admin role, the platform performs a two-step operation: first adds the user as a Member (Grafana’s default), then calls SetTeamMemberPermission to upgrade them to Admin.
Scope of the Team Admin Role
The team Admin role is a Grafana-native permission scoped to team management within the Grafana UI. It allows the member to manage that team’s settings and membership through Grafana’s own interface.
|
The team Admin role has no effect on authorisation decisions within the Kloudfuse platform. All platform-level authorisation (access to policies, user management, and administrative endpoints) is determined solely by the user’s organisation role (Admin, Editor, or Viewer) — not by their team-level permission. |
All team management operations performed through the Kloudfuse API (adding or removing members, updating or deleting a team) require the requesting user to hold a Grafana organisation-level Admin role. A team Admin member has no elevated privileges for these operations via the Kloudfuse API.
