Grafana with SSO: logging in with the local user (?disableAutoLogin), roles overwritten on every login (skip_org_role_sync) and provisioned data sources with secrets
/login?disableAutoLogin=true to reach the local form; grafana cli admin reset-admin-password if you also forgot the password. skip_org_role_sync: true per provider so Grafana stops overwriting roles; or role_attribute_path with role_attribute_strict. Data sources in provisioning/datasources with editable: false, secrets in secureJsonData, removal with deleteDatasources or prune: true.