Overview
Access control in Turbo360 governs who can view, configure, and manage resources across the platform. It operates through a combination of role-based access control (RBAC), organization-level user management, and Azure service principal permissions. Understanding the access control model helps you enforce least-privilege access and maintain clear boundaries between teams.
Business value
A well-configured access control structure prevents unauthorized changes, limits the blast radius of compromised accounts, and gives team leads visibility into who can act on which resources — reducing both security risk and support overhead.
How it works
Turbo360's access control model has two distinct layers: platform access (who can use Turbo360 and at what permission level) and Azure access (what Turbo360 can read or modify in your Azure subscriptions via service principals).
Platform roles
Turbo360 uses predefined roles to control user permissions within the portal. Roles can be assigned at two levels:
- Platform level — assigned when adding a user from Settings > Users. Applies across the entire Turbo360 platform.
- Module level — assigned per product (Business Applications, Business Activity Monitoring, Azure Documenter, Cost Analyzer) via the Specify product permissions dialog. Overrides the platform-level role for that module.
The available system-defined roles are:
| Role | Description |
|---|---|
| Account owner | Full access to all platform features, including organization settings, user management, subscription configuration, and service principal management. |
| Owner | Can create, modify, and delete resources within modules (Cost Analyzer, Business Applications, BAM, Azure Documenter). Cannot manage users or platform settings. |
| Contributor | Can create, modify, and delete resources within modules (Cost Analyzer, Business Applications, BAM, Azure Documenter). Cannot manage users or platform settings. |
| Reader | Read-only access to all module data and dashboards. Cannot create, modify, or delete any resources. |
Custom roles can be created at the module level only. Platform-level role assignments are limited to the system-defined roles above.
Organization-level access
- Users are added to a Turbo360 organization and assigned a role at the platform level from Settings > Users.
- Role assignment cannot be updated from the Users page after a user is added. To change a user's role, use the module-level permissions settings.
- Module-level permissions can be set independently per product using the Specify product permissions dialog, which overrides the platform-level role for that module.
- Organization admins can invite users, assign roles, and remove users via Settings > Users.
- Users authenticated via Microsoft Entra ID SSO inherit their identity from the identity provider. Role assignment within Turbo360 is separate from Azure RBAC roles.
Service principal access
Service principals represent Turbo360's identity when connecting to your Azure subscriptions. They are distinct from user identities.
- Each Azure subscription connected to Turbo360 requires a service principal with a defined set of Azure RBAC permissions.
- The minimum required Azure permissions for a service principal depend on which Turbo360 modules are enabled for that subscription.
- Service principals should be scoped to the subscription level, not the management group or tenant level, unless cross-subscription aggregation requires broader scope.
- Service principal credentials (client ID and secret) are stored encrypted within Turbo360. They are not accessible to end users after initial configuration.
Access boundaries
- Users cannot access data from subscriptions they are not authorized to view. Subscription visibility is controlled by the organization's service principal configuration, not by individual user settings.
- The Reader role cannot perform any write operations — resource creation, configuration changes, alert configuration, and task scheduling are all blocked.
- Account owners have access to audit logs, which record all user actions across the organization.