Steps:

1. In a terminal such as bash or PowerShell, login to Azure with the az login  command and choose the appropriate subscription that contains the Azure Flexible Server as a resource.
   
   

   Login to the Azure CLI

   az login

2. If you already have an app registration that you wish to use with Redgate Monitor, you can search for it by its display name to retrieve its application ID, which will be used later:
   
   

   Retrieve app registration ID

   # Change 'Redgate Monitor' in the command below to your own app registration name
   
   az ad app list --filter "startswith(displayName, 'Redgate Monitor')" --query "[].{displayName:displayName, appId:appId}"
   
   # Example command output:
   [
     {
       "appId": "446gf34d-3da8-5a57-9gfc-6962f16ed896",
       "displayName": "Redgate Monitor"
     }
   ]
   

   
   If you do not have an existing registration, you can create one first using the following command:
   
   

   Create app registration

   az ad app create --display-name "Redgate Monitor"
   

3. With the application ID retrieved from above, use the following command to create a new client secret (called password in the output) within that application. You should save the output for creating cloud service credentials in Monitor.
   
   

   Create Secret App Registration

   # Change 'appId' below to your own application ID as retrieved from step 1.
   
   az ad app credential reset --append --id "<appId>" --display-name "flex-monitor"
   
   # Example command output:
   {
     "appId": "446gf34d-3da8-5a57-9gfc-6962f16ed896",
     "password": "*****",
     "tenant": "124b26cd-db3f-4dc2-85ec-408758fb8b8e"
   }

4. Now, retrieve the object ID for the app registration using the following command. This will be used to assign it the "Monitoring Reader" role on the Azure flex instance:
   
   

   Retrieve object ID

   # Replace 'Redgate Monitor' with the name of the app registration from step 2.
   
   az ad sp list --all --query "[].{displayName:displayName, appObjectId:id}" --display-name "Redgate Monitor"
   
   # Example command output
   [
     {
       "displayName": "Redgate Monitor",
       "appObjectId": "e49bddbd-e1e6-445f-9ef2-4b3f69d690d2"
     }
   ]

5. It also necessary to retrieve the resource ID for the Azure Flexible Server instance, which will act as the scope for our role. You can do that with the following command, which will list the Flexible Server instances and their resource IDs:
   
   

   Retrieve the resource ID

   az postgres flexible-server list --query "[].{name:name,flexResourceId:id}"
   
   # Example command output
   [
     {
       "flexResourceId": "/subscriptions/f71d87ce-fa7f-405b-bb77-d7b375fcff34/resourceGroups/redgate/providers/Microsoft.DBforPostgreSQL/flexibleServers/azureflex",
       "name": "azureflex"
     }
   ]

6. Using the object ID from step 4, as well as the resource ID for your Azure flexible server instance from step 5, we can assign the built-in "Monitoring Reader" role to your app registration, which will give it access to the metrics of the database instance.
   
   

   Assign a role

   # Replace 'appObjectId' in the command below with the app registration's object ID, and 'flexResourceId' with the resource ID for the Flexible Server retrieved in the previous steps.
   
   az role assignment create --assignee "appObjectId" --role "Monitoring Reader" --scope "flexResourceId"

   
   Optionally, if you wish to monitor a number of instances on the same resource group or subscription, you can increase the scope by only including the relevant sections. For example:
   
   

   Assign a role with a greater scope

   # To give permission to monitor all instances in a resource group:
   az role assignment create --assignee "appObjectId" --role "Monitoring Reader" --scope "/subscriptions/f71d87ce-fa7f-405b-bb77-d7b375fcff34/resourceGroups/redgate"
   
   # To give permission to monitor all instances in a subscription:
   az role assignment create --assignee "appObjectId" --role "Monitoring Reader" --scope "/subscriptions/f71d87ce-fa7f-405b-bb77-d7b375fcff34"
   

7. You should now be able to use advanced monitoring for your Azure Flex instance in Monitor.