Sign in with Google, Microsoft or your SSO

Applies toPutki 2026.09 – 2026.122026.09: the updated 2026.09 monitoring bundle, the one with a bin folder.

Instead of creating a Grafana account per person, let people sign in with the accounts they already have. The monitoring Grafana supports:

• Google (Google Workspace or Gmail accounts)
• Microsoft Entra ID (formerly Azure AD)
• Any OpenID Connect provider: Keycloak, Okta, Auth0, Authentik and others

Everyone who signs in gets the Viewer role unless you list them as an admin or editor. The local admin login keeps working, so you can always get back in.

Before you start

Grafana must be reachable at a fixed address over HTTPS, and know it: set GRAFANA_ROOT_URL and GRAFANA_COOKIE_SECURE=true as in Expose Grafana safely. The provider sends people back to that address after they sign in.

Google

1. In the Google Cloud console, create an OAuth client ID of type Web application (Google: set up OAuth 2.0).

2. Add <GRAFANA_ROOT_URL>login/google as an authorized redirect URI, for example https://monitoring.example.com/login/google.

3. In .env:

   GRAFANA_GOOGLE_CLIENT_ID=1234-abcd.apps.googleusercontent.com
   GRAFANA_GOOGLE_CLIENT_SECRET=GOCSPX-...
   GRAFANA_SSO_ALLOWED_DOMAINS=example.com

GRAFANA_SSO_ALLOWED_DOMAINS is required with Google. Without it every Google account in the world could sign in as a Viewer, so Google sign-in stays off and Grafana's log says why. If that is really what you want, set GRAFANA_SSO_ALLOW_ANY_ACCOUNT=true instead.

Microsoft Entra ID

1. In the Microsoft Entra admin center, under App registrations, register an application (Microsoft: register an application).

2. Add a Web redirect URI: <GRAFANA_ROOT_URL>login/azuread.

3. Under Certificates & secrets, create a client secret.

4. In .env, with the IDs from the application's Overview:

   GRAFANA_ENTRA_TENANT_ID=00000000-0000-0000-0000-000000000000
   GRAFANA_ENTRA_CLIENT_ID=11111111-1111-1111-1111-111111111111
   GRAFANA_ENTRA_CLIENT_SECRET=...

Only accounts of your tenant can sign in. The admin and editor lists below match the address people sign in with.

Keycloak or another OpenID Connect provider

1. Create a client of type OpenID Connect, confidential, with the standard (authorization code) flow, and <GRAFANA_ROOT_URL>login/generic_oauth as a valid redirect URI.

2. In .env:

   GRAFANA_OIDC_ISSUER=https://sso.example.com/realms/example
   GRAFANA_OIDC_CLIENT_ID=putki-monitoring
   GRAFANA_OIDC_CLIENT_SECRET=...
   GRAFANA_OIDC_NAME=Example SSO

GRAFANA_OIDC_ISSUER is the issuer URL, for Keycloak the realm URL. The paths below it are Keycloak's; for other providers set GRAFANA_OIDC_AUTH_URL, GRAFANA_OIDC_TOKEN_URL and GRAFANA_OIDC_API_URL to the authorization, token and userinfo endpoints from their .well-known/openid-configuration. GRAFANA_OIDC_NAME is the text on the sign-in button.

A Keycloak in front of other providers is also how to offer Google and Microsoft through one button.

Choose who can do what

GRAFANA_SSO_ADMINS=ann@example.com
GRAFANA_SSO_EDITORS=bob@example.com,carl@example.com

Role	Can
Admin	Everything, including users, data sources and alert settings
Editor	Change dashboards and alert rules
Viewer	Look at the dashboards and logs

Everyone not listed is a Viewer. With GRAFANA_SSO_DEFAULT_ROLE=None, people not listed can still sign in but see nothing: Grafana's None role has no permissions. GRAFANA_SSO_ALLOWED_DOMAINS limits every provider, not only Google.

Roles are applied at every sign-in, so removing someone from a list takes effect the next time they sign in. For roles from your provider's groups or app roles instead of a list, set GRAFANA_SSO_ROLE_ATTRIBUTE_PATH to a JMESPath expression over the user's claims, for example contains(groups[*], 'monitoring-admins') && 'Admin' || 'Viewer'.

Apply and try it

docker compose -f docker-compose-monitoring.yml up -d

The sign-in page now has a button per provider. Grafana's log names the providers it switched on:

docker compose -f docker-compose-monitoring.yml logs grafana | grep "Putki SSO"

Sign-in through the provider only

Once a sign-in through the provider has worked, you can hide the username and password form:

GRAFANA_SSO_ONLY=true

With one provider, the sign-in page then sends people straight to it. The local admin account still exists but has no form to sign in with. If the provider is ever unavailable, set GRAFANA_SSO_ONLY=false and run up -d again to get the form back.

In the full Putki stack

Set the same variables in the stack's .env. Use the stack's address for Grafana in GRAFANA_ROOT_URL, for example https://monitoring.example.com/.