--- title: Configure Service Principal for Subscriptions canonical: "https://cloudmonitor.ai/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions/" description: "Part 1 of Step 3 (Configure Permissions): grant your existing CloudMonitor Service Principal the roles it needs to monitor the chosen Azure subscriptions." --- :::danger This is Part 1 of the Step 3. Configure Permissions step. At this point, you should have already set up your Service Principal and Client Secret. If you have not yet done that, go back and do Step 1 first. ::: :::tip There are 5 important points to note about Security with CloudMonitor: 1. YOU choose which Subscriptions you would like CloudMonitor to monitor. 2. If you have Management Groups set up then this is much easier to use instead of individual Subscriptions. 3. CloudMonitor has READ-ONLY access and cannot update anything. 4. CloudMonitor cannot read the data inside of Azure services like keys or database contents. 5. You need to have the OWNER Role to be able to follow these steps. ::: ### Step 1 For each Azure Subscription that you want to monitor, add the CloudMonitor Service Principal that you selected during installation as the READER role at the Subscription scope. Start by selecting the Azure Subscription in the Azure portal: ![For each Azure Subscription that you want to monitor, add the CloudMonitor Service Principal that you selected during installation as the…](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-01.jpeg) :::tip In this walkthrough we will use the Subscription "IE - MPN" as an example. ::: ### Step 2 Click on "Access control (IAM)" inside of the Subscription. ![Click on "Access control (IAM)" inside of the Subscription](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-02.jpeg) ### Step 3 Click "**\+ Add**" to add a new Role/Scope. ![Click "\+ Add" to add a new Role/Scope](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-03.jpeg) :::tip Note: If the “+ Add” button is greyed out then your logged in user does not have the OWNER Role and will be unable to proceed. Contact your IT department to find out who can do this step for you. ::: ### Step 4 Choose **"Add role assignment"** ![Choose "Add role assignment"](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-04.jpeg) ### Step 5 Select the **"Reader"** role. This only allows CloudMonitor to read service-plane metadata and costs, but not the contents inside of services such as database data and key vault keys. ![Select the "Reader" role. This only allows CloudMonitor to read service-plane metadata and costs, but not the contents inside of services…](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-05.jpeg) ### Step 6 Click **"Next"** ![Click "Next"](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-06.jpeg) ### Step 7 Choose **"User, group, or service principal"** and click **"Select members"** ![Choose "User, group, or service principal" and click "Select members"](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-07.jpeg) ### Step 8 Type in the name of your **Service Principal** and select it from the drop down list. You can also search by the App Id (Client Id) of your service principal to ensure you have the right one. ![Type in the name of your Service Principal and select it from the drop down list](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-08.jpeg) :::tip Note: In our walkthroughs we use the Service Principal named "CloudMonitor-SP”. ::: ### Step 9 Click **"Select"** ![Click "Select"](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-09.jpeg) ### Step 10 Click **"Next"**. ![Click "Next"](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-10.jpeg) ### Step 11 Review the details and click **"Review + assign"** ![Review the details and click "Review + assign"](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-11.jpeg) :::tip Note: CloudMonitor only has read-access to your Subscription and can in no way make any updates to your resources. You can also set IAM access at the Management Group level if this has been configured and you have many Subscriptions. ::: ### Step 12 The CloudMonitor Engine now has the access it needs to monitor this Subscription. Repeat this step for as many Subscriptions as you wish, or consider using a Management Group to allow all new Subscriptions to be monitored automatically. :::tip CloudMonitor requires certain Read permissions in order to monitor the status of your resources. \ If you elect not to grant these permissions, CloudMonitor will not be able to provide warnings on various critical issues, such as expired Service Principal secrets. ::: ### Step 13 Navigate to[Azure Active Directory > App Registrations](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps), and click your CloudMonitor Service Principal by name or ClientId under the "All applications" tab. ![Navigate toAzure Active Directory > App Registrations, and click your CloudMonitor Service Principal by name or ClientId under the "All…](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-12.jpeg) ### Step 14 On the side menu, under Manage, click **"API permissions"** and then click **"Add a permission"**. ![On the side menu, under Manage, click "API permissions" and then click "Add a permission"](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-13.jpeg) ### Step 15 In the modal window that opens, click **"Microsoft Graph"**. ![In the modal window that opens, click "Microsoft Graph"](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-14.jpeg) ### Step 16 Click **"Application permissions"** and search for [[Application.Read.All]] in the select permissions input field. Then add the read permission by clicking "Add permissions" below. ![Click "Application permissions" and search for [[Application.Read.All\]\] in the select permissions input field](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-15.jpeg) ### Step 17 Repeat the last step for the same Service Principal, adding these read permissions:\ • [[AuditLog.Read.All]]\ • [[Directory.Read.All]] ![Repeat the last step for the same Service Principal, adding these read permissions:\ • [[AuditLog.Read.All\]\]\ • [[Directory.Read.All\]\]](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-16.jpeg) ### Step 18 Click "Grant admin consent for ...". This action requires a user with Admin rights. ![Click "Grant admin consent for ...". This action requires a user with Admin rights](../../../../assets/docs/installing-cloudmonitor/configure-your-service-principal-monitor-subscriptions-17.jpeg) :::danger Next Step: Configure Permissions Part 2: [Allow CloudMonitor to access and view Billing Information : CloudMonitor Helpdesk](https://cloudmonitor.ai/docs/how-to-articles/allow-cloudmonitor-access-view-billing-information/) :::