--- title: "Step 6: Configure SP for Admin App access" canonical: "https://cloudmonitor.ai/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access/" description: "In order to be able to log in to the Admin App and create Cost Groups and remediate recommendations, you need to first configure the Service Principal." --- In order to be able to log in to the Admin App and create Cost Groups and remediate recommendations, you need to first configure the Service Principal. Click on **Get Started** below to follow the walkthrough. :::tip Changes need to be made to the Service Principal to allow users to log in to the CloudMonitor Admin App. ::: ### Step 1 Open your Azure Portal in a new browser window ([portal.azure.com](https://portal.azure.com)). You need to be logged into Azure as an Active Directory Administrator. Open "Microsoft Entra ID" (formerly "Azure Active Directory"). ![You need to be logged into Azure as an Active Directory Administrator. Open "Microsoft Entra ID" (formerly "Azure Active Directory")](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-01.jpeg) ### Step 2 Open the Service Principal (also known as an "App Registration") that you added previously for CloudMonitor. You can do this by searching for the Service Principal Name or ClientId. In our case, it is "CloudMonitor-SP". ![In our case, it is "CloudMonitor-SP"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-02.jpeg) ### Step 3 Once you have the Service Principal open, select "Authentication" in the left menu and click on "Add a platform" and choose "Single-page application". ![Once you have the Service Principal open, select "Authentication" in the left menu and click on "Add a platform" and choose "Single-page…](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-03.jpeg) ### Step 4 Copy and paste the Admin App Url provided to you by the CloudMonitor support team into the Redirect URIs. If you do not know what this is, contact Support and we'll find it for you. ![Copy and paste the Admin App Url provided to you by the CloudMonitor support team into the Redirect URIs](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-04.jpeg) ### Step 5 Check both checkboxes for Access Tokens and ID Tokens and ensure that the "Supported account types" option is set to Single Tenant only and save. ![Check both checkboxes for Access Tokens and ID Tokens and ensure that the "Supported account types" option is set to Single Tenant only and…](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-05.jpeg) ### Step 6 Then choose "Expose an API" in the left menu and click on "Add a scope" ![Then choose "Expose an API" in the left menu and click on "Add a scope"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-06.jpeg) ### Step 7 Add the word "**/appRoles**" to the end of the Application ID URI (Do not change anything else) and click on "Save and continue". ![Add the word "/appRoles" to the end of the Application ID URI (Do not change anything else) and click on "Save and continue"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-07.jpeg) ### Step 8 Enter "User.Read" in the "Scope name" field and select "Admins and users". ![Enter "User.Read" in the "Scope name" field and select "Admins and users"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-08.jpeg) ### Step 9 Click the "Admin consent display name" field and enter "UserRoles". Copy this into the "Admin consent description", as well as the "User consent display name" and "User consent description" and click on "Add scope" to save. ![Click the "Admin consent display name" field and enter "UserRoles"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-09.jpeg) ### Step 10 Select "App roles" in the left menu. and click on "Create app role". ![Select "App roles" in the left menu. and click on "Create app role"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-10.jpeg) ### Step 11 Enter "Support" as the name and choose "Applications". ![Enter "Support" as the name and choose "Applications"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-11.jpeg) ### Step 12 Click on the Value field and enter "Support", then copy and paste this into the Description field too. Ensure that the app role is enabled and click on "Apply" to save. ![Click on the Value field and enter "Support", then copy and paste this into the Description field too](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-12.jpeg) ### Step 13 Select "API permissions" in the left menu and click on "Add a permission". ![Select "API permissions" in the left menu and click on "Add a permission"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-13.jpeg) ### Step 14 Choose "APIs my organization uses". ![Choose "APIs my organization uses"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-14.jpeg) ### Step 15 Click the "Start typing an API name or Application ID" field, then search and click on the name of your Service Principal (in our cased it is "CloudMonitor-SP"). ![Search the "API name or Application ID" field and select your Service Principal](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-15.jpeg) ### Step 16 Choose "Application permissions". ![Choose "Application permissions"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-16.jpeg) ### Step 17 and check the "Support" permission and Click "Add permissions" ![and check the "Support" permission and Click "Add permissions"](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-17.jpeg) :::tip Click on "Grant admin consent for your organization". Note: Only Admin are allowed to grant consent. ::: ### Step 18 After doing the steps in adding the support application permission and has been granted by your administrator, it should look like this. ![After doing the steps in adding the support application permission and has been granted by your administrator, it should look like this](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-18.jpeg) ### Step 19 You have now configured the Admin App for login. Navigate to your Admin App Url and test that you are able to log in with the Admin Account you specified during the CloudMonitor engine install. If you have an issues, raise a helpdesk ticket and our support team will get back to you. ![Navigate to your Admin App Url and test that you are able to log in with the Admin Account you specified during the CloudMonitor engine…](../../../../assets/docs/installing-cloudmonitor/step-6-configuring-service-principal-admin-app-access-19.jpeg)