# User Permissions **URL:** \ **Category:** openHistorian\ **Created:** [February 24, 2025, 2:36am UTC](http://discussions.gridprotectionalliance.org/t/user-permissions/1378 "2025-02-24T02:36:21Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![OHUser1](http://discussions.gridprotectionalliance.org/letter_avatar_proxy/v4/letter/o/db5fbb/32.png) [@OHUser1](http://discussions.gridprotectionalliance.org/u/OHUser1)\ **Post date:** [February 24, 2025, 2:36am UTC](http://discussions.gridprotectionalliance.org/t/user-permissions/1378/1 "2025-02-24T02:36:21Z")
Hi GPA team, Just wondering about granularity in the grafana/openHistorian user permissions? We have our openHistorian tied into AD with 2 x dedicated groups for admin and viewing (generic users). Ultimately, my goal is to have ‘generic users’ AD group being able to - View the back end database configuration, but not edit it - Create new and Edit dashboards within Grafana At present: - The Admin AD group is allowed to all the Application Roles (ie Administrator, Editor, GrafanaAdmin, Viewer). - The ‘Generic Users’ AD group is allowed only to the ‘Viewer’ Application Role. If I change the ‘Generic Users’ AD group to the ‘GrafanaAdmin’ role, it doesn’t allow for editing of the backend database, but also doesn’t allow for creating and editing dashboards. If I change them to the ‘Editor’ role, this gives them access to change the back end database/PMU configurations, something that I want to restrict. Is there a way of getting more granularity in the permissions between the backend database and the grafana interface, if it is all managed by AD? Cheers, Scott ---
**Author:** ![ritchiecarroll](http://discussions.gridprotectionalliance.org/user_avatar/discussions.gridprotectionalliance.org/ritchiecarroll/32/2_2.png) [@ritchiecarroll](http://discussions.gridprotectionalliance.org/u/ritchiecarroll)\ **Post date:** [February 24, 2025, 2:38am UTC](http://discussions.gridprotectionalliance.org/t/user-permissions/1378/2 "2025-02-24T02:38:16Z")
If I understand your question correctly, it is to have read/write access in Grafana, but keep read-only access to OH config, right? ---
**Author:** ![OHUser1](http://discussions.gridprotectionalliance.org/letter_avatar_proxy/v4/letter/o/db5fbb/32.png) [@OHUser1](http://discussions.gridprotectionalliance.org/u/OHUser1)\ **Post date:** [February 24, 2025, 2:46am UTC](http://discussions.gridprotectionalliance.org/t/user-permissions/1378/3 "2025-02-24T02:46:20Z")
Hi Ritchie, That’s correct, having read only to OH, but read/write to Grafana. I’d like users to be able to create and edit whatever dashboards they dream up with, but can’t edit the overall OH configuration. Cheers, Scott ---
**Author:** ![ritchiecarroll](http://discussions.gridprotectionalliance.org/user_avatar/discussions.gridprotectionalliance.org/ritchiecarroll/32/2_2.png) [@ritchiecarroll](http://discussions.gridprotectionalliance.org/u/ritchiecarroll)\ **Post date:** [February 24, 2025, 2:58am UTC](http://discussions.gridprotectionalliance.org/t/user-permissions/1378/4 "2025-02-24T02:58:45Z")
Currently roles in Grafana are synchronized to those in openHistorian given that this Grafana instance is hosted-by and runs-behind the openHistorian web interface. This means all security for this Grafana instance is managed by openHistorian. Without a code update to accommodate a quasi-user role like this, my quick answer would be to say this is not currently supported with the hosted instance of Grafana. However, this is a perfectly valid use case, so I will add a task to make sure this gets on our TO-DO list. That said, Grafana is highly configurable - so you can certainly setup a _standalone_ instance of Grafana, connect it to openHistorian, and manage security yourself. In this case a data source connection to openHistorian would be setup with a single read-only type user. FYI - the Grafana Admin role in openHistorian is a “super user” role for access to advanced Grafana settings, e.g., managing organizations / sites, etc. Would not grant this to end users, just because they might be able to change things in the hosted Grafana instance that they should not. Will setup a task for your request right-away, i.e., a “Grafana Editor” role that will allow read/write access within Grafana while not affecting primary openHistorian role. Thanks, Ritchie ---
**Author:** ![OHUser1](http://discussions.gridprotectionalliance.org/letter_avatar_proxy/v4/letter/o/db5fbb/32.png) [@OHUser1](http://discussions.gridprotectionalliance.org/u/OHUser1)\ **Post date:** [February 24, 2025, 3:03am UTC](http://discussions.gridprotectionalliance.org/t/user-permissions/1378/5 "2025-02-24T03:03:24Z")
Excellent, appreciate the quick turn around with this Ritchie, thanks for adding it to your to-do list. In the meantime, I’ll do some investigation around setting up a stand alone instance of grafana, haven’t explored that yet, thanks for the tip. Cheers, Scott