This is Part 1 of the Step 3. Configure Permissions step. At this point, you should have already set up your Service Principal and Client Secret. If you have not yet done that, go back and do Step 1 first.

There are 5 important points to note about Security with CloudMonitor: 

1. YOU choose which Subscriptions you would like CloudMonitor to monitor.
2. If you have Management Groups set up then this is much easier to use instead of individual Subscriptions.
3. CloudMonitor has READ-ONLY access and cannot update anything.
4. CloudMonitor cannot read the data inside of Azure services like keys or database contents.
5. You need to have the OWNER Role to be able to follow these steps.

Please find the "2_AssignIAMReaderRoleToCloudMonitorServicePrincipal.ps1" from the ConfigureCloudMonitorServicePrincipal folder and execute it in the PowerShell.

Please provide the necessary inputs when required.

If the final output looks like below,\
\
**Reader Role has been assigned to the CloudMonitor Service Principal for the entered list of Subscriptions: &lt;YourSubscriptions&gt;**

It means the user creation is successful.

Note: CloudMonitor only has read-access to your Subscription and can in no way make any updates to your resources. You can also set IAM access at the Management Group level if this has been configured and you have many Subscriptions. 

The CloudMonitor Engine now has the access it needs to monitor this Subscription. Repeat this step for as many Subscriptions as you wish, or consider using a Management Group to allow all new Subscriptions to be monitored automatically. 

CloudMonitor requires certain Read permissions in order to monitor the status of your resources. \
If you elect not to grant these permissions, CloudMonitor will not be able to provide warnings on various critical issues, such as expired Service Principal secrets.

Please find the "1_CreateCloudMonitorServicePrincipal.ps1" from the ConfigureCloudMonitorServicePrincipal folder and execute it in the PowerShell.

Please provide the necessary inputs when required.

If the final output looks like below,\
\
**CloudMonitor App has been configured. Please allow 5 minutes before checking Azure Portal.**

It means the user creation is successful.

Next Step: Configure Permissions Part 2: [Allow CloudMonitor to access and view Billing Information : CloudMonitor Helpdesk](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000387644--powershell-allow-cloudmonitor-to-access-and-view-billing-information)

Configure your Service Principal to Monitor Subscriptions