--- title: "Architecture overview" slug: "architecture-overview" updated: 2026-10-30T06:37:33Z published: 2026-10-30T06:37:33Z canonical: "docs.turbo360.com/architecture-overview" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt > Use this file to discover all available pages before exploring further. # Architecture overview ## Overview This article describes how Turbo360 is architecturally structured, how it connects to Azure, how data flows through the platform, and how the five modules relate to the underlying infrastructure. ### Business value Understanding the architecture helps administrators plan deployments, configure service principals correctly, and troubleshoot connectivity or data issues with confidence. ## How it works Turbo360 connects to your Azure environment through service principals and brings the data it needs into five modules. The sections below cover how it connects, how data flows into each module, and how modules stay separate and controlled. ![Turbo360 architecture.png](https://cdn.document360.io/a21734f9-5f67-4835-bb81-a488f8191fa8/Images/Documentation/Turbo360%20architecture.png) ### Connectivity model Turbo360 connects to Azure through service principals registered in your Microsoft Entra ID tenant. Each service principal acts as an identity Turbo360 uses to read data from your Azure subscriptions. You register the service principal in Azure, assign it the required roles on your subscriptions, and then provide the credentials to Turbo360 during subscription setup. The required roles vary by module. For example, assign Reader at the subscription scope, and add Cost Management Reader for Cost Analyzer. Turbo360 does not require write access for most operations; read permissions are sufficient for Cost Analyzer, Business Applications monitoring, and Azure Documenter. BAM in push mode works the other way around. Your integrations send data to Turbo360's API, and no inbound Azure access is required for that flow. For most modules, no resources are deployed in your Azure subscription, because Turbo360 reads data remotely through the service principal. The exception is BAM with bring-your-own-backend, which requires a deployment. Tenant Manager connects differently. It uses an app registration in Microsoft Entra ID with Microsoft Graph application permissions and admin consent, instead of Azure roles. One service principal can serve several modules as long as it has the permissions each module needs. You can also use separate service principals per module or per subscription for tighter access control. ### Data flow Each module follows a distinct data flow pattern. Turbo360 encrypts data at rest and in transit. **Cost Analyzer** pulls billing and resource data from Azure Cost Management APIs on a scheduled import cycle. Imported data is stored in Turbo360 and made available for analysis, budgeting, and reporting. Azure Cost Management data can lag by 24 to 48 hours, and Turbo360 imports it as soon as Azure makes it available. For more information, see [Cost Analyzer architecture](https://docs.turbo360.com/docs/cost-analyzer-architecture). **Business Applications** queries Azure resource metadata and health signals at regular intervals. Monitoring rules evaluate the collected data and generate alerts when conditions are met. For more information, see [Business Applications architecture](https://docs.turbo360.com/docs/business-applications-architecture). **Business Activity Monitoring** operates in two modes. In push mode, your integrations send transaction events to Turbo360's BAM API. In pull mode, Turbo360 queries supported Azure data sources (Application Insights, Log Analytics, and others) to retrieve transaction data. For more information, see [Business Activity Monitoring architecture](https://docs.turbo360.com/docs/bam-architecture). **Azure Documenter** generates documentation on demand or on a schedule by querying Azure Resource Manager and other Azure APIs for subscription and resource metadata. For more information, see [Azure Documenter architecture](https://docs.turbo360.com/docs/architecture-1). **Tenant Manager** connects to your Microsoft 365 tenants through an app registration in Microsoft Entra ID, copies the data it needs into Turbo360 on a sync every 6 hours, and shows it in a tree of tenant groups and tenants. For more information, see [Tenant Manager architecture](https://docs.turbo360.com/docs/architecture-in-tenant-manager). ### Isolation and access control Modules are separate from each other, and access is controlled both in Turbo360 and in Azure. Each module is independently deployed and configured. Enabling or disabling one module has no effect on the others. Data collected by one module is not shared with or visible from another. Turbo360 uses role-based access control (RBAC) to manage user permissions within the platform. Roles are assigned at the organization level and can be scoped per module. Azure-side permissions are managed separately through service principal role assignments in Azure. Administrators manage service principal configuration and subscription connections. Other users can't change connectivity settings, but they can use modules within the permissions of their assigned role. ## Limitations Keep these constraints in mind when you plan a deployment. - Turbo360 Private hosting is limited to the following Azure environments: Azure Global Cloud, Azure China Cloud, and Azure US Government. - One service principal can be shared across multiple subscriptions, but permissions and scopes must be explicitly assigned on each subscription. ## Related articles - [What is Turbo360?](https://docs.turbo360.com/docs/what-is-turbo360) - [Product overview](https://docs.turbo360.com/docs/product-overview-1) - [Key capabilities](https://docs.turbo360.com/docs/key-capabilities) - [Connect Azure subscription](https://docs.turbo360.com/docs/connect-azure-subscription) - [Architecture guides](https://docs.turbo360.com/docs/architecture-guides)