Changes need to be made to the Service Principal to allow users to log in to the CloudMonitor Admin App.

Open your Azure Portal in a new browser window (https://portal.azure.com).

You need to be logged into Azure as an Active Directory Administrator. Open the "Azure Active Directory" management screen.

Open the Service Principal that you added for CloudMonitor. You can do this by searching for the Service Principal name or ClientId. 

In our case, it is "CloudMonitor-SP".

Once you have the Service Principal open, click on "Authentication" in the left menu.

Configure browser client applications and progressive web applications. Javascript.

Copy and paste the Admin App Url provided to you by the CloudMonitor support team into the Redirect URIs. If you do not know what this is, contact Support and we'll find it for you.

Check both checkboxes for Access Tokens and ID Tokens.

Ensure that the "Supported account types" option is set to Single Tenant only and save.

The click "Expose an API" in the left menu.

Add the word "/appRoles" to the end of the Application ID URI (Do not change anything) and click on "Save and continue".

Click the "Scope name" field and enter "User.Read"

Click the "Admin consent display name" field and enter "UserRoles".

Copy this into the "Admin consent description", as well as the "User consent display name" and "User consent description" and click on "Add scope" to save.

Enter "Support" as the name and choose "Applications".

Click on the Value field and enter "Support", then copy and paste this into the Description field too. Ensure that the app role is enabled and click on "Apply" to save.

Click on "API permissions" in the left menu.

Find and click on the name of your Service Principal (in our cased it is "CloudMonitor-SP").

Application permissions
Your application runs as a background service or daemon without a signed-in user.

and check the "Support" permission and Click "Add permissions"

Make sure that your permission is granted by the Admin.

Note: Only Admin are allowed to grant consent.

After doing the steps in adding the support application permission and has been granted by your administrator, it should look like this.

You have now configured the Admin App for login. 

Navigate to your Admin App Url and test that you are able to log in with the Admin Account you specified during the CloudMonitor engine install. If you have an issues, raise a helpdesk ticket and our support team will get back to you.

Step 5: Configuring the Service Principal for Admin App access