For CloudMonitor to receive cost data and perform maintenance activities, the following **Role assignments** are required:

**CloudMonitor Service Principal:**

- **Reader Role** on the CloudMonitor Managed Resource Group
  - Reason: Control plane access is needed prior to accessing Synapse Workspace which is provided by the least privileged reader role.
- **Synapse Administrator Role** on the Synapse Workspace inside of the CloudMonitor Managed Resource Group
  - Reason: Role is required to deploy Synapse artifacts.

**CloudMonitor Synapse AD B2B User:**

- **Synapse Administrator Role** on the Synapse Workspace inside of the CloudMonitor Managed Resource Group
  - Reason: Role is required to perform maintenance activities. This user's RBAC permissions are scoped to the Synapse Workspace inside of the CloudMonitor Engine IP only and they cannot do or see anything outside of the Managed Resource Group.
- **Storage Blob Data Contributor** on the CloudMonitor Storage Account.
  - Reason: Role is required to perform maintenance activities.

**Synapse Workspace Resource:**

- **Storage Blob Data Contributor** on the CloudMonitor Storage Account.
  - Reason: Role is required to deploy Synapse artifacts.

We will assume that you have already added [synapse@cloudmonitor.ai](mailto:synapse@cloudmonitor.ai) as a Guest B2B User in your Azure tenant. If not, please go back and complete Step 2 – Part 1 [How to create the CloudMonitor Synapse B2B User : CloudMonitor Helpdesk](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000373084-how-to-create-the-cloudmonitor-synapse-b2b-user)before proceeding.

The next steps will cover assigning the **Reader Role** to your **CloudMonitor Service Principal** on your CloudMonitor Managed Resource Group.

**Reason:** Roles are required to deploy Synapse artifacts and perform maintenance activities.

Navigate to [Azure Portal - Managed Applications](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Solutions%2Fapplications)and locate your CloudMonitor Managed Application. Then select it.

Azure Managed Applications allow us to deliver our engine as a service, and handle the underlying Azure Resources.

mrg-cloudmonitor-analytics-20230606144910

Navigate to **Access Control (IAM)** and click **"Add"**.

Switch to the **Members** tab, and click **"Select members"**.

Search for and select your **CloudMonitor Service Principal name**.

Please visit our other article [How to access your AD Service Principal details](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000346604-how-to-access-your-ad-service-principal-details) for help locating your Service Principal name.

Then click **"Select"** and then click **"Review + assign"**.

You will receive a notification for successfully assigning the Reader Role.

Remain on this page in preparation for the next section.

CloudMonitor-SP was added as Reader for mrg-cloudmonitor-analytics-20230606144910.

The next steps will cover assigning the **Storage Blob Data Contributor** in a designated Storage Account Resource to the:

- Synapse Workspace Resource
- CloudMonitor Synapse AD B2B User

Reason: Role is required to deploy Synapse artifacts.

Under **Resources**:

1. Search for "CMSDLR" in the filter field.
2. Then click the Storage Account Resource returned.

Select **"Storage Blob Data Contributor"** as the role.

Storage Blob Data Contributor
Allows for read, write and delete access to Azure Storage blob containers and data
BuiltInRole
Storage
View

Search for and select your **CloudMonitor Service Principal name**.

Then back to the **Members** tab, tick the option **"Managed identity"**.

Select "Synapse workspace" for the Managed identity option.

Then select the Synapse Workspace Resource that becomes available.

It should begin with characters "synwspace".

You will receive a notification for successfully assigning the Storage Blob Data Contributor Roles.

2 Role assignments were added as Storage Blob Data Contributor for cmsdlrsygegtd4gwosm.

The next steps will cover the last task — assigning the **Synapse Administrator Role** in the Synapse Workspace to the:

- **CloudMonitor Service Principal**
- **CloudMonitor Synapse AD B2B User**

**Reason**: Roles are required to deploy Synapse artifacts and perform maintenance activities.

Again from the Managed Resource Group, navigate to the "Overview" page.

Under **Resources**:

1. Search for "Synapse Workspace" in the filter field.
2. Then click the Synapse Workspace Resource returned.

Click **"Open"** to open the **Synapse Studio.**

**This step is only required in the event that you encounter the below specified error message after authenticating. If you are not experiencing this issue, kindly disregard this step and proceed to the next one.**

If you are receiving this error message, please visit the website <https://whatismyipaddress.com> and obtain your IP address.

Once you have it, email this information to [support@cloudmonitor.ai](mailto:support@cloudmonitor.ai) and wait for our response before proceeding with the next steps.

After authenticating successfully, you will be redirected to a new window and be confronted with a 403 error code. This is **expected** behavior. You can safely click "OK" and proceed to the next step.

Click on the **"Manage icon"** on the left sidebar.

Under Security, click **"Access control"**.

Click the "Select a role" field, and select **"Synapse Administrator"** as the role.

Search for and select the **CloudMonitor Synapse User [[(synapse@cloudmonitor.ai)]]**.

You will receive a notification for successfully assigning the Synapse Administrator Role.

Successfully added the role assignments
Successfully added 2 role assignments for the Synapse Administrator role for Workspace. This change may take 2-5 minutes to take effect.

Note: You will not see any records here—this is expected behaviour.

Add
Refresh
Remove access
Filter by name
Type
:
All
Role
:
All
Scope:
All

Showing 0 - 0 of 0 role assignments at all scopes in the workspace (0 user(s), 0 group(s), 0 service principal(s))

Name
Type
Role
Scope
Failed to load
Failed to load role assignments due to forbidden issue, error code 403. Refresh or troubleshoot the issue. 
Learn more
View details

You have completed all requirements to give CloudMonitor the ability to receive cost data and perform maintenance activities.

Let's move on to [Step 3: Configure Permissions : CloudMonitor Helpdesk](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000379419-step-3-configure-permissions) where we configure permissions to monitor your chosen Azure Subscriptions, and access and view billing information.

Configure CloudMonitor Synapse