For CloudMonitor to receive cost data, the below is required of customers:

1. Create a new **Storage Account** **Resource** to serve as a container for cost data from the Azure Export API.

2. Assign the **Storage Account Contributor Role** to the CloudMonitor Service Principal.

3. Create a **SAS Connection String** for the Storage Account. This is required to grant CloudMonitor secure and limited access to resources in the Storage Account without exposing the access key.

Proceed for step-by-step instructions.

In Azure Portal, navigate to the [Storage accounts - Microsoft Azure](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Storage%2FStorageAccounts) and click **"Create"**.

Select a Resource Group in which to create the new Storage Account. We recommend setting up a new Resource Group.

If you are a NonCSP Customer, the chosen Subscription **MUST** be in the same Subscription as the CloudMonitor Engine.

If you are a CSP Customer, your Customer may choose any Subscription, the new Storage Account **MUST** be created in their tenancy.

Name the Storage Account in accordance with your existing organisational tagging standards and naming conventions.

To avoid paying egress fees select the **same** region that contains the CloudMonitor engine.

Choose **LRS** for storage redundancy, then click **"Advanced"**.

Make sure Hierarchical Namespace is **unticked**. then click **"Review"** and **"Create"**.

You will receive a notification for when the Storage Account has been successfully deployed. Click **"Go to resource"** in preparation for the next section.

Before proceeding to the next set of instructions, we require that the new Storage Account's **Subscription** is registered with the **Microsoft.CostManagementExports** Azure Resource Provider.

This is necessary to use the Export API, without this, CloudMonitor cannot perform cost export operations on the Storage Account in that Subscription.

Navigate to [Subscriptions - Microsoft Azure](https://portal.azure.com/#view/Microsoft_Azure_Billing/SubscriptionsBladeV2) and select the same Subscription the Storage Account will be located in.

AZ – MPN (Visual Studio Enterprise Subscription)

Filter by and select **"Microsoft.CostManagementExports"** and then click **"Register"**.

You will receive a notification for successfully registering the Resource Provider.

The next steps will cover how to assign the **Storage Account Contributor Role** to the **CloudMonitor Service Principal**.

Reason: Role is required to create Scheduled Exports when utilizing the Azure Export API.

Navigate to the Storage Account Resource we just created.

Navigate to **Access Control (IAM)** and click **"Add &gt; Add role assignment"**.

Under the **Role** tab, select **"Storage Account Contributor"** as the Role.

Switch to the **Members** tab, and click **"Select members"**.

Search and select your **CloudMonitor Service Principal** name.

Switch to the **Review + assign** tab and "Review + assign".

You will receive a notification for successfully assigning the "Storage Account Contributor" role.

Next step is to verify whether "Permitted Scope for Copy Operation" is correct.

Navigate to the Storage Account and Click "Configuration"

Expand the drop down of "Permitted Scope for Copy Operation" and Click "From any storage account"

The next steps will cover the last task — creating a SAS Connection String for the Storage Account.

Reason: Required to grant CloudMonitor secure and limited access to resources in the storage account without exposing the access key.

On the same Storage Account Resource, click **"Shared access signature"**.

To ensure secure and minimal access configure the SAS with the following settings:

1. Under **Allowed Services**, check **'Blob'** to restrict access to Blob storage only.
2. For **Allowed Resource Types**, select **'Service', 'Container'** and **'Object'** to permit operations at the service, container and blob level.
3. Choose **Allowed Permissions** **'Read', 'Write', 'Delete', 'List'**, and **'Create'** to exclusively manage blob content within the container.
4. Do not enable any other services or permissions not specified here.

Apply these settings to provide CloudMonitor with the necessary permissions to manage blobs without overextending access rights.

When setting the SAS expiration, it's advised to **choose a date two years from today** to ensure continued access without frequent renewal.

Click **"Generate SAS and connection string"**

1. Find the **Blob Service SAS URL** located at the bottom of the page. Copy this URL and store it securely.
2. Also, copy the **URL of this webpage**. It contains the Storage Account Resource ID.
3. Finally, email the copied information to [support@cloudmonitor.ai](mailto:support@cloudmonitor.ai) and confirm that you have completed this Helpdesk Article.

Next Step: [Step 4: Raise a Support Ticket : CloudMonitor Helpdesk](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000379420-step-4-raise-a-support-ticket)

Configuring Storage for CloudMonitor to schedule Exports (For CSP Customers Only)