​
Overview

The Grafana integration does two things for compliance:
  • User & team access review — imports your organization users (name, email, role), teams, and service accounts so LowerPlane can run access reviews, verify each account maps to a known person, and confirm offboarded employees lose access.
  • Monitoring evidence — collects Grafana alert rules to support continuous-monitoring controls.
LowerPlane uses read-only access via a Service Account Token. Works with self-hosted Grafana and Grafana Cloud.

​
Prerequisites

You need Organization Admin access in Grafana to create a service account and generate a token. The Admin role is required so LowerPlane can list your organization users (/api/org/users) for access reviews — a Viewer token cannot read the user list.

​
How to Get Your Service Account Token

1

Open Service accounts

In Grafana, go to Administration → Users and access → Service accounts.
2

Add a service account

Click Add service account, name it “LowerPlane”, and assign the Admin role.
On Grafana Enterprise you can instead create a custom role granting the org.users:read permission (plus reads for teams, datasources, and alerts) for least-privilege access.
3

Generate a token

Open the service account and click Add service account token. Copy the generated token — you can optionally set no expiration for continuous syncs.
Treat the token like a password — it grants API access to your Grafana organization.

​
Connecting in LowerPlane

  1. Go to Settings > Integrations in LowerPlane
  2. Find Grafana under Analytics
  3. Enter your Grafana URL:
    • Self-hosted — https://grafana.yourcompany.com
    • Grafana Cloud — https://<your-stack>.grafana.net
  4. Enter your Service Account Token
  5. Click Connect

​
What LowerPlane Collects

Organization Users

Every org user with name, email, and role (Admin/Editor/Viewer). Each account is matched to your LowerPlane people directory for access reviews.

Access Level

Each user’s Grafana role, used as the access-level signal for reviews (Admins flagged as privileged).

Offboarding Status

Cross-checks each user’s email against HR to flag accounts belonging to terminated employees.

Account Identification

Verifies every account is traceable to a named individual (no anonymous or shared accounts).

Teams

Grafana teams and their membership, as access-grouping evidence for reviews.

Alert Rules

Alert rules as monitoring evidence, supporting continuous-monitoring controls.

Service Accounts

Non-human (API) service accounts and their roles, so machine access is reviewed too.

​
Compliance Mapping

FrameworkControlsWhat It Proves
SOC 2CC6.1, CC6.2, CC6.3Access is provisioned to identified users and removed on offboarding
SOC 2CC7.1, CC7.2System monitoring and alerting controls are in place
ISO 27001A.5.16, A.5.18Identity management and access rights are controlled and revoked
ISO 27001A.8.15, A.8.16Logging and monitoring activities are enforced

​
FAQ

Listing organization users via /api/org/users requires the org.users:read permission, which the Admin role includes. A Viewer or alerting-only token returns 403 and no users are collected. On Grafana Enterprise, a custom role with org.users:read is a least-privilege alternative.
Grafana’s API does not expose per-user two-factor authentication status. The only related field (authLabels) lives on the server-admin /api/users endpoint, which service-account tokens cannot call. Enforce MFA through your Grafana SSO/SAML provider instead.
Yes. Enter your Grafana Cloud stack URL (https://<your-stack>.grafana.net) and a service-account token created in that stack. Self-hosted Grafana uses the same flow with your instance URL.
Grafana data syncs every 24 hours by default. You can trigger a manual sync from the integration settings.