Redash User Management Guide

• Model type: role-based
• Description: Redash uses a group-based permission model. Every user belongs to one or more groups. Data sources are granted to groups, and queries/dashboards inherit visibility from group membership. There are two built-in groups: 'default' (all users) and 'admin'. Admins can create additional custom groups and assign data sources to them.
• Custom roles: Yes
• Custom roles plan: Self-hosted (no paid tier required; custom groups are available in the open-source version)
• Granularity: Data-source level: access is granted per data source per group. Query and dashboard sharing is per-object. There is no row-level or column-level permission control.

1. Log in as an Admin.
2. Navigate to Settings > Users (path: /users).
3. Click the 'New User' button.
4. Enter the user's Name and Email address.
5. Click 'Create'.
6. An invitation email is sent to the provided address. The user sets their own password via the invitation link.
7. Optionally, assign the user to additional groups from the user detail page.

Required fields: Name, Email address

Watch out for:

• Invitation emails require a correctly configured mail server (REDASH_MAIL_* environment variables). If mail is not configured, the invitation link will not be delivered.
• New users are automatically added to the 'default' group. They will not have access to any data sources unless the 'default' group has data sources assigned, or they are added to another group with data source access.
• There is no built-in bulk CSV import for users in the standard UI.

• Can delete users: Yes
• Delete/deactivate behavior: Redash supports both disabling (deactivating) and deleting users. Disabling a user prevents login but retains their data. Deletion is available via the admin UI or API and permanently removes the user record. The official help docs and source code both reference a disable action; deletion is also present in the codebase and admin interface.

1. Log in as an Admin.
2. Navigate to Settings > Users (path: /users).
3. Locate the user and open their profile.
4. Click 'Disable' to deactivate the user. The user will no longer be able to log in.
5. To re-enable, return to the same profile and click 'Enable'.

Watch out for:

• Disabling a user does not revoke existing shared links to dashboards if those links are public/token-based.
• If SSO is enabled, a disabled user may still be able to attempt login via the IdP; the disable flag in Redash will block the session regardless.
• Deleted users' queries and dashboards become orphaned (no owner) but remain accessible.

• Where to check usage: Settings > Users (path: /users) - lists all users with their status (active/disabled) and last login information.
• How to identify unused seats: Sort or filter the user list by 'Last Active At' column in Settings > Users to identify users who have not logged in recently. No automated idle-user report is built in.
• Billing notes: Redash is open-source software with no per-seat licensing. The official Redash cloud service was discontinued in November 2021 following the Databricks acquisition. Third-party managed hosting providers (e.g., Elestio) may charge per-user fees under their own pricing, which is not set by the Redash project.

Because Redash has no native SCIM support, user lifecycle tasks that would be automated in other tools fall back to manual administration or custom scripting against the REST API.

Adding a user requires an admin to navigate to Settings > Users, create the record, and then separately assign group memberships - group assignment is the only mechanism that controls data source access.

Removing a user means locating their profile and clicking Disable; there is no bulk offboarding workflow built into the UI, and disabling a user does not automatically revoke access to shared dashboards with public or token-based links.

When evaluating Redash against every app in your BI or analytics stack, the key variable is how much operational ownership your team can absorb. The group-based model works well when data source boundaries map cleanly to team boundaries, but it breaks down when you need object-level or attribute-level access control.

If your organization requires IdP-driven lifecycle management, Redash's SAML integration handles authentication but leaves provisioning and deprovisioning as a manual or scripted responsibility. Teams should weigh the operational overhead of self-hosting against the absence of licensing costs before committing.

Bottom line

Redash delivers capable query and dashboard tooling at zero licensing cost, but that trade-off comes with full operational ownership. User lifecycle management - onboarding, group assignment, and offboarding - is entirely manual through the admin UI or the REST API, with no SCIM path available.

For small, technically fluent teams with stable rosters the overhead is manageable; for organizations with frequent staff changes or compliance-driven provisioning requirements, the gap between what Redash offers natively and what enterprise IAM workflows demand will require deliberate engineering investment to close.