This blog post will dig into some more depth on what’s really required to share dashboards in Azure from a user rights/security perspective. If you are interested in creating custom dashboards, integrating Log Analytics and customizing dashboards this previous blog post covers those topics. This blog post will discuss:
- Permissions required to share dashboards in Azure
- Changing who can see your shared dashboard
- Permissions required to see content on your dashboard
Sharing dashboards in Azure:
To share a dashboard and be able to add others to be able to share it must be an Owner on the subscription level. The graphic below shows the users tab when you do not have owner rights.
With owner rights on the subscription you have the new Add button shown below.
If you do not have at least contributor rights you will be unable to choose the subscription when trying to share a dashboard as shown in the screenshots below.
“Users who are owners or contributors are able to list, view, create, modify, or delete dashboards within the subscription. Users who are readers are able to list and view dashboards, but cannot modify or delete them. Users with reader access are able to make local edits to a published dashboard (such as, when troubleshooting an issue), but are not able to publish those changes back to the server. They will have the option to make a private copy of the dashboard for themselves” from https://docs.microsoft.com/en-us/azure/azure-portal/azure-portal-dashboard-share-access
Based on our testing, to allow a user to create their own dashboard and share it required Owner level permissions so that they were able to manage who else can view that dashboard. If the user only needs to be able to share the dashboard and not control who can view it contributor level is sufficient.
Changing who can see your shared dashboard:
Once you have shared a dashboard, use the “Unshare” option to change permissions on that dashboard.
Clicking on Unshare brings up a new view on the right side where you can now choose “Manage users”.
From this view you can add or remove users and roles.
Permissions required to display objects on a dashboard:
The following are the access permissions which we have seen for the objects on a dashboard:
- Reader rights in the OMS workspace (this is done in OMS)
- Contributor rights in Azure to Log Analytics
- Reader rights to the “mms-eus” resource group (IE: The resource group where the Log Analytics workspace is stored)
- Reader rights to the “dashboards” resource group (IE: The resource group where the dashboards are stored)
From a high level you need to have at least reader rights to any data that you are sharing on the dashboard (and anyone who needs to see those on the dashboard should need permissions well).
Summary: To effectively share and control who has access to your shared dashboard you need owner rights on the subscription. When you want to change who can see your shared dashboard use the “Unshare” option. Finally, you need at least reader rights to the OMS workspace, contributor rights in Azure to Log Analytics, and reader access to the dashboards resource group to view the various objects on your shared dashboard (if you are displaying Log Analytics content as an example).
The Azure portal provides an easy to use dashboard experience which allows you to easily pin items from Azure and other sources into your own custom dashboards. This blog post will showcase the following:
- How to quickly create your own dashboards
- How to share your custom dashboard
- How to add content from the Azure portal
- How to add content from Log Analytics
- How to add content from Application Insights
- Customizing your dashboards
Creating your own dashboard:
To create your own dashboard, log into the Azure portal and choose the option to create new dashboard.
Provide a name for the dashboard and then you can temporarily call this done by choosing the “Done customizing” option.
The Tile Gallery on the right provides a large number of items which can be easily added to your dashboard so if you haven’t already finished customizing your dashboard you can try some of these out before you save off the dashboard.
The Video option is an interesitng one as you can enter a title, a subtitle and a link to a video and it will embed on the dashboard. The other one that I reguarly use is the “Markdown” option.
For now we’ll just complete customizing so that we have a dashboard where we can pin a variety of items.
Adding content to your dashboard from the Azure portal
Within the Azure portal you can pin any view that you see to the custom dashboard which you created. As an example for some of the views in the portal there is a pin directly on a portion of the screen such as the one shown below.
Or you can pin a link to the same view in the top right corner of the page.
Adding content to your dashboard from Log Analytics
If you open your Log Analytics workspace in the Azure portal you can open the overview pane to see the top level of view of your OMS workspace.
From this view you can see the various solutions you have added to the workspace. Any of these top level views can be added to your custom dashboard by right-clicking on them and choosing the option “Pin to Dashboard’ shown below. In the example below we are pinning the top level view of the Server and Client Performance solution which was shown in a previous blog post.
Unfortunately you cannot currently pin dashboard views which appear in further drill-downs within the Log Analytics portal. A workaround for this will be discussed in the “Adding content to your dashboard from Application Insights” section of this blog post.
Sharing your custom dashboard
To share your custom dashboard click on the Share option shown below.
You will need to choose the name, subscription name, and location as well as checking the option to publish this into a resource group called ‘dashboards’ (Note: this will be important when providing access to the dashboard later, note where you add this for later).
Choose the publish option at the bottom to make this available. Please note, the order of these steps is important as you need to perform this step before adding any content from Application Insights to the dashboard.
Adding content to your dashboard from Application Insights
Within Application Insights you can pin any queries that you run or any graphs that you create directly to your dashboard. For example, let’s say that I wanted to display data like what I have in the drill-down for the server monitoring dashboard related to disk space. The graphic below is the drill down within the Log Analytics top level view of the Server and Client performance solution.
Unfortunately, as we have already seen it’s not possible to pin these dashboards. We can however drill down into this view and open the query in advanced analytics.
From Advanced Analytics we can visualize the data as text or with a variety of charts such as the sample below. Once you have the data visualized the way that you want you can pin it to a dashboard with the pin icon shown below.
When you pin the view it will let you choose from your shared dashboards (see the “Sharing your custom dashboard” section of this blog post).
Note: This same approach to pinning views to the dashboards works throughout Application Insights regardless of whether you go there directly from Application Insights or from a view within Log Analytics.
Customizing your dashboards
Now that we have added content to our dashboard and published any changes that we made we can see what it looks like.
That’s not bad but it could use a little clarification as to what is actually on the screen. That’s where the “Markdown” option comes in handy. We can edit the dashboard to move things around and to add some additional content.
You can drag over a Markdown and then make some customizations.
On the right side I change the title and then remove the subtitle and content.
Then I resize the markdown to match the size that I need. An example is shown below with markdowns added for clarification on what is on the dashboard. Once the changes are done, publish them to make the updated dashboard available.
And there you go! A sample shared dashboard with content from Azure, Application Insights and Log Analytics all together.
Note: One of the challenges with the Azure dashboard is the time range it displays. Based on my testing this appears to be a 24 hour time range for Log Analytics dashboard items and Application Insights appears to be a 14 day time range. I have not found an option which allows you to specify what the time range is for the dashboard, but you can drill into dashboard items and use the Filter option with the view that you drilled down into.
Summary: The Azure portal’s dashboard capability makes it easy to add content from within Azure, Log Analytics or Application Insights to provide your own sharable customized dashboards. There are a couple of challenges that I have run into (inability to pin lower level views from Log Analytics, and inability to set the time range for your dashboard) but overall I would recommend trying this out.