For CloudMonitor to receive cost data and perform maintenance activities, the following **Role assignments** are required:

**CloudMonitor Service Principal:**

- **Reader Role** on the CloudMonitor Managed Resource Group
  - Reason: Control plane access is needed prior to accessing Synapse Workspace which is provided by the least privileged reader role.
- **Synapse Administrator Role** on the Synapse Workspace inside of the CloudMonitor Managed Resource Group
  - Reason: Role is required to deploy Synapse artifacts.

**CloudMonitor Synapse AD B2B User:**

- **Synapse Administrator Role** on the Synapse Workspace inside of the CloudMonitor Managed Resource Group
  - Reason: Role is required to perform maintenance activities. This user's RBAC permissions are scoped to the Synapse Workspace inside of the CloudMonitor Engine IP only and they cannot do or see anything outside of the Managed Resource Group.
- **Storage Blob Data Contributor** on the CloudMonitor Storage Account.
  - Reason: Role is required to perform maintenance activities.

**Synapse Workspace Resource:**

- **Storage Blob Data Contributor** on the CloudMonitor Storage Account.
  - Reason: Role is required to deploy Synapse artifacts.

We will assume that you have already added [synapse@cloudmonitor.ai](mailto:synapse@cloudmonitor.ai) as a Guest B2B User in your Azure tenant. If not, please go back and complete Step 2 – Part 1 [How to create the CloudMonitor Synapse B2B User : CloudMonitor Helpdesk](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000387630--powershell-how-to-create-the-cloudmonitor-synapse-b2b-user)before proceeding.

The next steps will cover assigning the **Reader Role** to your **CloudMonitor Service Principal** on your CloudMonitor Managed Resource Group.

**Reason:** Roles are required to deploy Synapse artifacts and perform maintenance activities.

Please find the "4_ConfigureCloudMonitorServicePrincipalForSynapse.ps1" from the ConfigureCloudMonitorServicePrincipal folder and execute it in the PowerShell.

Please provide the necessary inputs when required.

If the final output looks like below,\
\
**CloudMonitor Service Principal has now been assigned the 'Reader' and 'Synapse Administrator' Roles on the CloudMonitor Managed Resource Group**

It means the execution is successful.

The next steps will cover assigning the **Storage Blob Data Contributor** in a designated Storage Account Resource to the:

- Synapse Workspace Resource
- CloudMonitor Synapse AD B2B User

Reason: Role is required to deploy Synapse artifacts.

Please find the "1_ConfigureSynapseWorkspaceAndStorageAccountConnectio n.ps1" from the ConfigureCloudMonitorServicePrincipal folder and execute it in the PowerShell.

Please provide the necessary inputs when required.

If the final output looks like below,\
\
**The CloudMonitor Synapse Workspace now has the 'Storage Blob Data Contributor' Role on the Storage Account within the CloudMonitor Managed Resource Group.**

It means the execution is successful.

The next steps will cover the last task — assigning the **Synapse Administrator Role** in the Synapse Workspace to the:

- **CloudMonitor Service Principal**
- **CloudMonitor Synapse AD B2B User**

**Reason**: Roles are required to deploy Synapse artifacts and perform maintenance activities.

Please find the "2_ConfigureB2BUserForSynapse.ps1" from the ConfigureB2BSynapseCloudMonitorUser folder and execute it in the PowerShell.

Please provide the necessary inputs when required.

If the final output looks like below,\
\
**Successfully assigned the CloudMonitor Synapse AD B2B User the 'Synapse Administrator' Role on the Synapse Workspace within the CloudMonitor Managed Resource Group**

**The CloudMonitor Synapse AD B2B User now has the 'Storage Blob Data Contributor' Role on the Storage Account within the CloudMonitor Managed Resource Group.**

It means the execution is successful.

You have completed all requirements to give CloudMonitor the ability to receive cost data and perform maintenance activities.

Let's move on to [Step 3: Configure Permissions : CloudMonitor Helpdesk](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000387633--powershell-step-3-configure-permissions) where we configure permissions to monitor your chosen Azure Subscriptions, and access and view billing information.

Configure CloudMonitor Synapse