Configure CloudMonitor Synapse

Tip

For CloudMonitor to receive cost data and perform maintenance activities, the following Role assignments are required:

CloudMonitor Service Principal:

• Reader Role on the CloudMonitor Managed Resource Group
  • Reason: Control plane access is needed prior to accessing Synapse Workspace which is provided by the least privileged reader role.
• Synapse Administrator Role on the Synapse Workspace inside of the CloudMonitor Managed Resource Group
  • Reason: Role is required to deploy Synapse artifacts.

Danger

CloudMonitor Synapse AD B2B User:

• Synapse Administrator Role on the Synapse Workspace inside of the CloudMonitor Managed Resource Group
  • Reason: Role is required to perform maintenance activities. This user’s RBAC permissions are scoped to the Synapse Workspace inside of the CloudMonitor Engine IP only and they cannot do or see anything outside of the Managed Resource Group.
• Storage Blob Data Contributor on the CloudMonitor Storage Account.
  • Reason: Role is required to perform maintenance activities.

Synapse Workspace Resource:

• Storage Blob Data Contributor on the CloudMonitor Storage Account.
  • Reason: Role is required to deploy Synapse artifacts.

Tip

We will assume that you have already added synapse@cloudmonitor.ai as a Guest B2B User in your Azure tenant. If not, please go back and complete Step 2 – Part 1 How to create the CloudMonitor Synapse B2B User : CloudMonitor Helpdeskbefore proceeding.

Tip

The next steps will cover assigning the Reader Role to your CloudMonitor Service Principal on your CloudMonitor Managed Resource Group.

Reason: Roles are required to deploy Synapse artifacts and perform maintenance activities.

Step 1

Navigate to Azure Portal - Managed Applicationsand locate your CloudMonitor Managed Application. Then select it.

Azure Managed Applications allow us to deliver our engine as a service, and handle the underlying Azure Resources.

Step 2

Click “Managed resource group”.

Step 3

Navigate to Access Control (IAM) and click “Add”.

Step 4

Then click “Add role assignment”.

Step 5

Select “Reader” as the role.

Step 6

Switch to the Members tab, and click “Select members”.

Step 7

Search for and select your CloudMonitor Service Principal name.

Please visit our other article How to access your AD Service Principal details for help locating your Service Principal name.

Step 8

Then click “Select” and then click “Review + assign”.

Step 9

You will receive a notification for successfully assigning the Reader Role.

Remain on this page in preparation for the next section.

Tip

The next steps will cover assigning the Storage Blob Data Contributor in a designated Storage Account Resource to the:

• Synapse Workspace Resource
• CloudMonitor Synapse AD B2B User

Reason: Role is required to deploy Synapse artifacts.

Step 10

Under Resources:

1. Search for “CMSDLR” in the filter field.
2. Then click the Storage Account Resource returned.

Step 11

Navigate to Access Control (IAM) and click “Add”.

Step 12

Click “Add role assignment”

Step 13

Select “Storage Blob Data Contributor” as the role.

Step 14

Switch to the Members tab, and click “Select members”.

Step 15

Search for and select your CloudMonitor Service Principal name.

Step 16

Then back to the Members tab, tick the option “Managed identity”.

Step 17

Click “Select members”

Step 18

Select “Synapse workspace” for the Managed identity option.

Step 19

Then select the Synapse Workspace Resource that becomes available.

It should begin with characters “synwspace”.

Step 20

Then click “Select” and then click “Review + assign”.

Step 21

You will receive a notification for successfully assigning the Storage Blob Data Contributor Roles.

Tip

The next steps will cover the last task — assigning the Synapse Administrator Role in the Synapse Workspace to the:

• CloudMonitor Service Principal
• CloudMonitor Synapse AD B2B User

Reason: Roles are required to deploy Synapse artifacts and perform maintenance activities.

Step 22

Again from the Managed Resource Group, navigate to the “Overview” page.

Step 23

Under Resources:

1. Search for “Synapse Workspace” in the filter field.
2. Then click the Synapse Workspace Resource returned.

Step 24

Click “Open” to open the Synapse Studio.

Step 25

This step is only required in the event that you encounter the below specified error message after authenticating. If you are not experiencing this issue, kindly disregard this step and proceed to the next one.

If you are receiving this error message, please visit the website whatismyipaddress.com and obtain your IP address.

Once you have it, email this information to support@cloudmonitor.ai and wait for our response before proceeding with the next steps.

Step 26

After authenticating successfully, you will be redirected to a new window and be confronted with a 403 error code. This is expected behavior. You can safely click “OK” and proceed to the next step.

Step 27

Click on the “Manage icon” on the left sidebar.

Step 28

Under Security, click “Access control”.

Step 29

Then click “Add”.

Step 30

Click the “Select a role” field, and select “Synapse Administrator” as the role.

Step 31

Search for and select the CloudMonitor Synapse User [[(synapse@cloudmonitor.ai)]].

Step 32

Click “Apply”

Step 33

You will receive a notification for successfully assigning the Synapse Administrator Role.

Step 34

Note: You will not see any records here—this is expected behaviour.

Danger

You have completed all requirements to give CloudMonitor the ability to receive cost data and perform maintenance activities.

Let’s move on to Step 3: Configure Permissions : CloudMonitor Helpdesk where we configure permissions to monitor your chosen Azure Subscriptions, and access and view billing information.