--- title: Configure CloudMonitor Synapse canonical: "https://cloudmonitor.ai/docs/installing-cloudmonitor/configure-cloudmonitor-synapse/" description: "Step 2 Part 2: assign the role assignments CloudMonitor Synapse needs in the Azure Portal so it can read cost data and run maintenance activities in your tenant." --- :::tip For CloudMonitor to receive cost data and perform maintenance activities, the following **Role assignments** are required: **CloudMonitor Service Principal:** - **Reader Role** on the CloudMonitor Managed Resource Group - Reason: Control plane access is needed prior to accessing Synapse Workspace which is provided by the least privileged reader role. - **Synapse Administrator Role** on the Synapse Workspace inside of the CloudMonitor Managed Resource Group - Reason: Role is required to deploy Synapse artifacts. ::: :::danger **CloudMonitor Synapse AD B2B User:** - **Synapse Administrator Role** on the Synapse Workspace inside of the CloudMonitor Managed Resource Group - Reason: Role is required to perform maintenance activities. This user's RBAC permissions are scoped to the Synapse Workspace inside of the CloudMonitor Engine IP only and they cannot do or see anything outside of the Managed Resource Group. - **Storage Blob Data Contributor** on the CloudMonitor Storage Account. - Reason: Role is required to perform maintenance activities. **Synapse Workspace Resource:** - **Storage Blob Data Contributor** on the CloudMonitor Storage Account. - Reason: Role is required to deploy Synapse artifacts. ::: :::tip We will assume that you have already added **synapse@cloudmonitor.ai** as a Guest B2B User in your Azure tenant. If not, please go back and complete Step 2 – Part 1 [How to create the CloudMonitor Synapse B2B User : CloudMonitor Helpdesk](https://cloudmonitor.ai/docs/installing-cloudmonitor/how-create-cloudmonitor-synapse-b2b-user/)before proceeding. ::: :::tip The next steps will cover assigning the **Reader Role** to your **CloudMonitor Service Principal** on your CloudMonitor Managed Resource Group. **Reason:** Roles are required to deploy Synapse artifacts and perform maintenance activities. ::: ### Step 1 Navigate to [Azure Portal - Managed Applications](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Solutions%2Fapplications)and locate your CloudMonitor Managed Application. Then select it. Azure Managed Applications allow us to deliver our engine as a service, and handle the underlying Azure Resources. ![Azure Managed Applications allow us to deliver our engine as a service, and handle the underlying Azure Resources](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-01.jpeg) ### Step 2 Click **"Managed resource group"**. ![Click "Managed resource group"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-02.jpeg) ### Step 3 Navigate to **Access Control (IAM)** and click **"Add"**. ![Navigate to Access Control (IAM) and click "Add"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-03.jpeg) ### Step 4 Then click **"Add role assignment"**. ![Then click "Add role assignment"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-04.jpeg) ### Step 5 Select **"Reader"** as the role. ![Select "Reader" as the role](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-05.jpeg) ### Step 6 Switch to the **Members** tab, and click **"Select members"**. ![Switch to the Members tab, and click "Select members"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-06.jpeg) ### Step 7 Search for and select your **CloudMonitor Service Principal name**. Please visit our other article [How to access your AD Service Principal details](https://cloudmonitor.ai/docs/how-to-articles/how-access-your-ad-service-principal-details/) for help locating your Service Principal name. ![Search for and select the CloudMonitor Service Principal name](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-07.jpeg) ### Step 8 Then click **"Select"** and then click **"Review + assign"**. ![Then click "Select" and then click "Review + assign"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-08.jpeg) ### Step 9 You will receive a notification for successfully assigning the Reader Role. Remain on this page in preparation for the next section. ![Remain on this page in preparation for the next section](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-09.jpeg) :::tip The next steps will cover assigning the **Storage Blob Data Contributor** in a designated Storage Account Resource to the: - Synapse Workspace Resource - CloudMonitor Synapse AD B2B User Reason: Role is required to deploy Synapse artifacts. ::: ### Step 10 Under **Resources**: 1. Search for "CMSDLR" in the filter field. 2. Then click the Storage Account Resource returned. ![Search for "CMSDLR" in the filter field. 2. Then click the Storage Account Resource returned](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-10.jpeg) ### Step 11 Navigate to **Access Control (IAM)** and click **"Add"**. ![Navigate to Access Control (IAM) and click "Add"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-11.jpeg) ### Step 12 Click **"Add role assignment"** ![Click "Add role assignment"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-12.jpeg) ### Step 13 Select **"Storage Blob Data Contributor"** as the role. ![Select "Storage Blob Data Contributor" as the role](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-13.jpeg) ### Step 14 Switch to the **Members** tab, and click **"Select members"**. ![Switch to the Members tab, and click "Select members"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-14.jpeg) ### Step 15 Search for and select your **CloudMonitor Service Principal name**. ![Search for and select your CloudMonitor Service Principal name](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-15.jpeg) ### Step 16 Then back to the **Members** tab, tick the option **"Managed identity"**. ![Then back to the Members tab, tick the option "Managed identity"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-16.jpeg) ### Step 17 Click **"Select members"** ![Click "Select members"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-17.jpeg) ### Step 18 Select "Synapse workspace" for the Managed identity option. ![Select "Synapse workspace" for the Managed identity option](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-18.jpeg) ### Step 19 Then select the Synapse Workspace Resource that becomes available. It should begin with characters "synwspace". ![It should begin with characters "synwspace"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-19.jpeg) ### Step 20 Then click **"Select"** and then click **"Review + assign"**. ![Then click "Select" and then click "Review + assign"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-20.jpeg) ### Step 21 You will receive a notification for successfully assigning the Storage Blob Data Contributor Roles. ![You will receive a notification for successfully assigning the Storage Blob Data Contributor Roles](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-21.jpeg) :::tip The next steps will cover the last task — assigning the **Synapse Administrator Role** in the Synapse Workspace to the: - **CloudMonitor Service Principal** - **CloudMonitor Synapse AD B2B User** **Reason**: Roles are required to deploy Synapse artifacts and perform maintenance activities. ::: ### Step 22 Again from the Managed Resource Group, navigate to the "Overview" page. ![Again from the Managed Resource Group, navigate to the "Overview" page](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-22.jpeg) ### Step 23 Under **Resources**: 1. Search for "Synapse Workspace" in the filter field. 2. Then click the Synapse Workspace Resource returned. ![Search for "Synapse Workspace" in the filter field. 2. Then click the Synapse Workspace Resource returned](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-23.jpeg) ### Step 24 Click **"Open"** to open the **Synapse Studio.** ![Click "Open" to open the Synapse Studio](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-24.jpeg) ### Step 25 **This step is only required in the event that you encounter the below specified error message after authenticating. If you are not experiencing this issue, kindly disregard this step and proceed to the next one.** If you are receiving this error message, please visit the website [whatismyipaddress.com](https://whatismyipaddress.com) and obtain your IP address. Once you have it, send this information to our team via [live chat](#chatbox) and wait for our response before proceeding with the next steps. ![Once you have it, send this information via the live chat in the bottom-right corner of cloudmonitor.ai and wait for our response before proceeding with the next steps](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-25.jpeg) ### Step 26 After authenticating successfully, you will be redirected to a new window and be confronted with a 403 error code. This is **expected** behavior. You can safely click "OK" and proceed to the next step. ![After authenticating successfully, you will be redirected to a new window and be confronted with a 403 error code](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-26.jpeg) ### Step 27 Click on the **"Manage icon"** on the left sidebar. ![Click on the "Manage icon" on the left sidebar](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-27.jpeg) ### Step 28 Under Security, click **"Access control"**. ![Under Security, click "Access control"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-28.jpeg) ### Step 29 Then click **"Add"**. ![Then click "Add"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-29.jpeg) ### Step 30 Click the "Select a role" field, and select **"Synapse Administrator"** as the role. ![Click the "Select a role" field, and select "Synapse Administrator" as the role](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-30.jpeg) ### Step 31 Search for and select the **CloudMonitor Synapse User [[(synapse@cloudmonitor.ai)]]**. ![Search for and select the CloudMonitor Synapse User [[(synapse@cloudmonitor.ai)\]\]](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-31.jpeg) ### Step 32 Click "Apply" ![Click "Apply"](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-32.jpeg) ### Step 33 You will receive a notification for successfully assigning the Synapse Administrator Role. ![You will receive a notification for successfully assigning the Synapse Administrator Role](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-33.jpeg) ### Step 34 Note: You will not see any records here—this is expected behaviour. ![Note: You will not see any records here—this is expected behaviour](../../../../assets/docs/installing-cloudmonitor/configure-cloudmonitor-synapse-34.jpeg) :::danger You have completed all requirements to give CloudMonitor the ability to receive cost data and perform maintenance activities. Let's move on to [Step 3: Configure Permissions : CloudMonitor Helpdesk](https://cloudmonitor.ai/docs/installing-cloudmonitor/step-3-configure-permissions/) where we configure permissions to monitor your chosen Azure Subscriptions, and access and view billing information. :::