---
title: Configure SP for Subscriptions (PowerShell)
canonical: "https://cloudmonitor.ai/docs/installing-cloudmonitor/powershell-configure-your-service-principal-monitor-subscriptions/"
description: "Azure PowerShell automation for Step 3 Part 1: assign the roles your CloudMonitor Service Principal needs to monitor the chosen Azure subscriptions."
---

:::danger
This is Part 1 of the Step 3. Configure Permissions step. At this point, you should have already set up your Service Principal and Client Secret. If you have not yet done that, go back and do Step 1 first.
:::

:::tip
There are 5 important points to note about Security with CloudMonitor: 

1. YOU choose which Subscriptions you would like CloudMonitor to monitor.
2. If you have Management Groups set up then this is much easier to use instead of individual Subscriptions.
3. CloudMonitor has READ-ONLY access and cannot update anything.
4. CloudMonitor cannot read the data inside of Azure services like keys or database contents.
5. You need to have the OWNER Role to be able to follow these steps.
:::

### Step 1

Please find the "2_AssignIAMReaderRoleToCloudMonitorServicePrincipal.ps1" from the ConfigureCloudMonitorServicePrincipal folder and execute it in the PowerShell.

Please provide the necessary inputs when required.

### Step 2

If the final output looks like below,\
\
**Reader Role has been assigned to the CloudMonitor Service Principal for the entered list of Subscriptions: `<YourSubscriptions>`**

It means the user creation is successful.

:::tip
Note: CloudMonitor only has read-access to your Subscription and can in no way make any updates to your resources. You can also set IAM access at the Management Group level if this has been configured and you have many Subscriptions.
:::

### Step 3

The CloudMonitor Engine now has the access it needs to monitor this Subscription. Repeat this step for as many Subscriptions as you wish, or consider using a Management Group to allow all new Subscriptions to be monitored automatically.

:::tip
CloudMonitor requires certain Read permissions in order to monitor the status of your resources. \
If you elect not to grant these permissions, CloudMonitor will not be able to provide warnings on various critical issues, such as expired Service Principal secrets.
:::

### Step 4

Please find the "1_CreateCloudMonitorServicePrincipal.ps1" from the ConfigureCloudMonitorServicePrincipal folder and execute it in the PowerShell.

Please provide the necessary inputs when required.

### Step 5

If the final output looks like below,\
\
**CloudMonitor App has been configured. Please allow 5 minutes before checking Azure Portal.**

It means the user creation is successful.

:::danger
Next Step: Configure Permissions Part 2: [Allow CloudMonitor to access and view Billing Information : CloudMonitor Helpdesk](https://cloudmonitor.ai/docs/installing-cloudmonitor/powershell-allow-cloudmonitor-access-view-billing-information/)
:::