For CloudMonitor to receive cost data and perform maintenance activities, the following **Role assignments** are required:

**CloudMonitor Service Principal:**

- **Reader Role** on the CloudMonitor Managed Resource Group
  - Reason: Control plane access is needed prior to accessing Synapse Workspace which is provided by the least privileged reader role.
- **Synapse Administrator Role** on the Synapse Workspace inside of the CloudMonitor Managed Resource Group
  - Reason: Role is required to deploy Synapse artifacts.

**CloudMonitor Synapse AD B2B User:**

- **Synapse Administrator Role** on the Synapse Workspace inside of the CloudMonitor Managed Resource Group
  - Reason: Role is required to perform maintenance activities. This user's RBAC permissions are scoped to the Synapse Workspace inside of the CloudMonitor Engine IP only and they cannot do or see anything outside of the Managed Resource Group.
- **Storage Blob Data Contributor** on the CloudMonitor Storage Account.
  - Reason: Role is required to perform maintenance activities.

**Synapse Workspace Resource:**

- **Storage Blob Data Contributor** on the CloudMonitor Storage Account.
  - Reason: Role is required to deploy Synapse artifacts.

We will assume that you have already added [synapse@cloudmonitor.ai](mailto:synapse@cloudmonitor.ai) as a Guest B2B User in your Azure tenant. If not, please go back and complete Step 2 – Part 1 [How to create the CloudMonitor Synapse B2B User : CloudMonitor Helpdesk](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000373084-how-to-create-the-cloudmonitor-synapse-b2b-user)before proceeding.

The next steps will cover assigning the **Reader Role** to your **CloudMonitor Service Principal** on your CloudMonitor Managed Resource Group.

**Reason:** Roles are required to deploy Synapse artifacts and perform maintenance activities.

Navigate to [Azure Portal - Managed Applications](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Solutions%2Fapplications)and locate your CloudMonitor Managed Application. Then select it.

Azure Managed Applications allow us to deliver our engine as a service, and handle the underlying Azure Resources.

mrg-cloudmonitor-analytics-20230606144910

Navigate to **Access Control (IAM)** and click **"Add"**.

Switch to the **Members** tab, and click **"Select members"**.

Search for and select your **CloudMonitor Service Principal name**.

Please visit our other article [How to access your AD Service Principal details](https://helpdesk.cloudmonitor.ai/support/solutions/articles/51000346604-how-to-access-your-ad-service-principal-details) for help locating your Service Principal name.

Then click **"Select"** and then click **"Review + assign"**.

You will receive a notification for successfully assigning the Reader Role.

Remain on this page in preparation for the next section.

CloudMonitor-SP was added as Reader for mrg-cloudmonitor-analytics-20230606144910.

The next steps will cover assigning the **Storage Blob Data Contributor** in a designated Storage Account Resource to the:

- Synapse Workspace Resource
- CloudMonitor Synapse AD B2B User

Reason: Role is required to deploy Synapse artifacts.

Under **Resources**:

1. Search for "CMSDLR" in the filter field.
2. Then click the Storage Account Resource returned.

Select **"Storage Blob Data Contributor"** as the role.

Storage Blob Data Contributor
Allows for read, write and delete access to Azure Storage blob containers and data
BuiltInRole
Storage
View

Configure CloudMonitor Synapse