---
title: "Access control"
slug: "access-control"
updated: 2026-10-29T11:13:36Z
published: 2026-10-29T11:13:36Z
canonical: "docs.turbo360.com/access-control"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access control

## Overview

Access control in Turbo360 governs who can view, configure, and manage resources across the platform. It operates through a combination of role-based access control (RBAC), organization-level user management, and Azure service principal permissions. Understanding the access control model helps you enforce least-privilege access and maintain clear boundaries between teams.

### Business value

A well-configured access control structure prevents unauthorized changes, limits the blast radius of compromised accounts, and gives team leads visibility into who can act on which resources, reducing both security risk and support overhead.

## How it works

Turbo360's access control model has two distinct layers: platform access (who can use Turbo360 and at what permission level) and Azure access (what Turbo360 can read or modify in your Azure subscriptions via service principals).

**Platform roles**

Turbo360 uses predefined roles to control user permissions within the portal. Roles can be assigned at two levels:

- **Platform level:** assigned when adding a user from **Settings** > **Users**. Applies across the entire Turbo360 platform.
- **Module level:** assigned per product (Business Applications, Business Activity Monitoring, Azure Documenter, Cost Analyzer, Tenant Manager) via the **Specify product permissions** dialog. Overrides the platform-level role for that module.

The available system-defined roles are:

| Role | Description |
| --- | --- |
| Account owner | Full access to all platform features, including organization settings, user management, subscription configuration, and service principal management. |
| Owner | Can create, modify, and delete resources within modules (Cost Analyzer, Business Applications, BAM, Azure Documenter, Tenant Manager). Cannot manage users or platform settings. |
| Contributor | Can create, modify, and delete resources within modules (Cost Analyzer, Business Applications, BAM, Azure Documenter, Tenant Manager). Cannot manage users or platform settings. |
| Reader | Read-only access to all module data and dashboards. Cannot create, modify, or delete any resources. |

Custom roles can be created at the module level only. Platform-level role assignments are limited to the system-defined roles above.

Tenant Manager has its own roles: the built-in Owner, Contributor, and Reader roles, plus custom roles. See [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions) for how access to the module works.

**Organization-level access**

- Users are added to a Turbo360 organization and assigned a role at the platform level from **Settings** > **Users**.
- Role assignment cannot be updated from the **Users** page after a user is added. To change a user's role, use the module-level permissions settings.
- Module-level permissions can be set independently per product using the **Specify product permissions** dialog, which overrides the platform-level role for that module.
- Organization admins can invite users, assign roles, and remove users via **Settings** > **Users**.
- Users authenticated via Microsoft Entra ID SSO inherit their identity from the identity provider. Role assignment within Turbo360 is separate from Azure RBAC roles.

**Service principal access**

Service principals represent Turbo360's identity when connecting to your Azure subscriptions. They are distinct from user identities.

- Each Azure subscription connected to Turbo360 requires a service principal with a defined set of Azure RBAC permissions.
- The minimum required Azure permissions for a service principal depend on which Turbo360 modules are enabled for that subscription.
- Service principals should be scoped to the subscription level, not the management group or tenant level, unless cross-subscription aggregation requires broader scope.
- Service principal credentials (client ID and secret) are stored encrypted within Turbo360. They are not accessible to end users after initial configuration.
- Tenant Manager connects to Microsoft 365 tenants, not Azure subscriptions, so it does not use Azure RBAC roles. Its service principal needs Microsoft Graph application permissions that your Microsoft Entra administrator grants. See [Connect a Microsoft 365 tenant](https://docs.turbo360.com/docs/connect-a-microsoft-365-tenant).

**Access boundaries**

- Users cannot access data from subscriptions they are not authorized to view. Subscription visibility is controlled by the organization's service principal configuration, not by individual user settings.
- The **Reader** role cannot perform any write operations. Resource creation, configuration changes, alert configuration, and task scheduling are all blocked.
- Account owners have access to audit logs, which record all user actions across the organization.

## Related articles

- [Security best practices](https://docs.turbo360.com/docs/security-best-practices)
- [Data protection](https://docs.turbo360.com/docs/data-protection)
- [Managing users - Microsoft Entra ID](https://docs.turbo360.com/docs/managing-users-in-microsoft-entra-id)
- [Managing users - email authentication](https://docs.turbo360.com/docs/managing-users-in-email-authentication)
- [Service principal management](https://docs.turbo360.com/docs/service-principal-management-4)
- [Entra ID SSO overview](https://docs.turbo360.com/docs/entra-id-sso-overview)
- [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions)