​
Overview

The Grafana integration does two things for compliance:
  • User & team access review — imports your organization users (name, email, role), teams, and service accounts so LowerPlane can run access reviews, verify each account maps to a known person, and confirm offboarded employees lose access.
  • Monitoring evidence — collects Grafana alert rules to support continuous-monitoring controls.
LowerPlane uses read-only access via a Service Account Token. Works with self-hosted Grafana and Grafana Cloud.

​
Prerequisites

You need Organization Admin access in Grafana to create a service account and generate a token. The Admin role is required so LowerPlane can list your organization users (/api/org/users) for access reviews — a Viewer token cannot read the user list.

​
How to Get Your Service Account Token

1

Open Service accounts

In Grafana, go to Administration → Users and access → Service accounts.
2

Add a service account

Click Add service account, name it “LowerPlane”, and assign the Admin role.
On Grafana Enterprise you can instead create a custom role granting the org.users:read permission (plus reads for teams, datasources, and alerts) for least-privilege access.
3

Generate a token

Open the service account and click Add service account token. Copy the generated token — you can optionally set no expiration for continuous syncs.
Treat the token like a password — it grants API access to your Grafana organization.

​
Connecting in LowerPlane

  1. Go to Settings > Integrations in LowerPlane
  2. Find Grafana under Analytics
  3. Enter your Grafana URL:
    • Self-hosted — https://grafana.yourcompany.com
    • Grafana Cloud — https://<your-stack>.grafana.net
  4. Enter your Service Account Token
  5. Click Connect

​
What LowerPlane Collects

Organization Users

Every org user with name, email, and role (Admin/Editor/Viewer). Each account is matched to your LowerPlane people directory for access reviews.

Access Level

Each user’s Grafana role, used as the access-level signal for reviews (Admins flagged as privileged).

Offboarding Status

Cross-checks each user’s email against HR to flag accounts belonging to terminated employees.

Account Identification

Verifies every account is traceable to a named individual (no anonymous or shared accounts).

Teams

Grafana teams and their membership, as access-grouping evidence for reviews.

Alert Rules

Alert rules as monitoring evidence, supporting continuous-monitoring controls.

Service Accounts

Non-human (API) service accounts and their roles, so machine access is reviewed too.

​
Compliance Mapping

​
FAQ

Listing organization users via /api/org/users requires the org.users:read permission, which the Admin role includes. A Viewer or alerting-only token returns 403 and no users are collected. On Grafana Enterprise, a custom role with org.users:read is a least-privilege alternative.
Grafana’s API does not expose per-user two-factor authentication status. The only related field (authLabels) lives on the server-admin /api/users endpoint, which service-account tokens cannot call. Enforce MFA through your Grafana SSO/SAML provider instead.
Yes. Enter your Grafana Cloud stack URL (https://<your-stack>.grafana.net) and a service-account token created in that stack. Self-hosted Grafana uses the same flow with your instance URL.
Grafana data syncs every 24 hours by default. You can trigger a manual sync from the integration settings.