Best practices

Overview

This article consolidates recommended practices for operating Turbo360 effectively across its core modules: Cost Analyzer, Business Applications, Business Activity Monitoring (BAM), and Azure Documenter. Following these practices helps you maintain a well-governed, observable, and cost-efficient Azure environment.

Business value

Applying consistent operational practices across Turbo360 reduces manual overhead, improves visibility into Azure spend and application health, and ensures your teams respond to issues before they escalate. These recommendations reflect patterns from production deployments and are aligned with Azure Well-Architected Framework principles.

How it works

Best practices in Turbo360 are organized into four areas aligned with the platform's core capabilities:

Cost optimization — reduce unnecessary Azure spend using Cost Analyzer budgets, anomaly detection, and rightsizing recommendations
Governance — enforce consistent tagging, access policies, and resource organization across subscriptions
Monitoring — configure proactive alerting and escalation policies across Business Applications and BAM to catch failures early
Security — apply least-privilege access, review audit logs regularly, and enforce SSO and MFA for all users

Cost optimization

Set budgets at the right granularity. Define budgets at the subscription, resource group, and cost group levels. Granular budgets surface anomalies faster than subscription-wide thresholds alone.
Enable anomaly detection on all active subscriptions. Configure anomaly detection in Cost Analyzer to alert when spend deviates from expected patterns. Set escalation policies so alerts reach the right owner automatically.
Review rightsizing recommendations monthly. Use the Rightsizing feature in Cost Analyzer to identify over-provisioned resources. Prioritize recommendations by estimated monthly savings and validate against actual usage patterns before resizing.
Use schedule automation for non-production resources. Apply schedule jobs to shut down or deallocate dev and test resources outside of working hours. This is one of the highest-impact cost reduction actions for most organizations.
Build shared cost views for stakeholders. Use saved views and scheduled reports to deliver cost data to finance, engineering, and business stakeholders on a regular cadence. This reduces ad hoc requests and builds cost awareness across teams.

Governance

Standardize cost groups to reflect your organizational structure. Map cost groups to business units, products, or teams. Consistent grouping makes chargeback and showback reporting reliable.
Use tagging policies to enforce metadata. Define required tags (such as environment, owner, cost-center) at the subscription or resource group level. Review untagged resource reports regularly and remediate gaps.
Restrict sensitive configuration to Admin roles. Limit access to organization settings, service principal management, and notification rules to users with the Admin role. Use Teams and role assignments to enforce least privilege for module-level actions.
Review access policies quarterly. Use the Users section in General settings to audit role assignments. Remove stale accounts and revoke permissions that are no longer required.
Maintain a single canonical service principal per subscription. Avoid creating multiple service principals for the same subscription. Document the service principal's permissions and review them when modules are added or upgraded.

Monitoring

Configure escalation policies for all critical Business Applications. Escalation policies ensure alerts are re-routed when the primary owner does not acknowledge them. Set escalation windows appropriate to your SLAs.
Use monitoring profiles to standardize alert thresholds. Define monitoring profiles for common application tiers (e.g., production, staging) and apply them consistently. This reduces configuration drift across Business Applications.
Enable query monitoring for Logic Apps and Service Bus. Query-based monitoring surfaces business-logic failures that infrastructure monitoring alone does not catch. Define expected record counts or throughput thresholds for critical integration flows.
Set up BAM duration monitoring for long-running transactions. Configure duration thresholds in BAM to detect stalled or delayed business processes before they affect downstream systems.
Review alert history weekly during initial deployment. In the first weeks after enabling monitoring, review alert history daily to tune thresholds and eliminate noise. Gradually move to weekly reviews once alert quality stabilizes.

Security

Enforce SSO and MFA for all users. Configure your identity provider in the Authentication & SSO section and require MFA for all sign-ins. Do not rely on username/password authentication for production access.
Review audit logs regularly. Review audit logs in Security & Compliance to detect unauthorized access or configuration changes. Export audit logs to your SIEM if your organization has one.
Rotate service principal credentials on a defined schedule. Set a reminder to review and rotate service principal credentials at least annually, or immediately following any security incident.
Apply the principle of least privilege. Grant users the minimum permissions needed to perform their role in Turbo360. Avoid assigning Admin roles to users who only need module-level read or write access.
Do not share service principal credentials across environments. Use separate service principals for production and non-production Azure subscriptions to limit the blast radius of a credential compromise.

Limitations

Rightsizing recommendations in Cost Analyzer are based on historical utilization data. Accuracy improves with at least 30 days of data per resource.
Schedule automation applies to supported resource types only. Verify resource type support before configuring schedule jobs.
Monitoring profiles in Business Applications apply to new resources added after the profile is assigned. Existing resources may require manual reconfiguration.
BAM duration monitoring requires the BAM environment to be deployed and connected. It is not available in organizations that have not completed BAM setup.

Troubleshooting

Anomaly detection alerts are not firing despite spend spikes.
Cause: The anomaly detection threshold may be set too high, or the subscription has insufficient historical data for the model to establish a baseline.
Fix: Verify that at least 14 days of cost data have been imported for the subscription. Lower the sensitivity threshold in the anomaly detection configuration and review the baseline period setting.
Rightsizing recommendations are not appearing.
Cause: The Cost Analyzer import may not have completed, or the resource has insufficient utilization history.
Fix: Confirm that the latest import completed successfully in the import validation view. Ensure the resource has at least 30 days of utilization data. Re-run the import if needed.
Escalation policy is not triggering after the defined window.
Cause: The escalation policy may not be associated with the correct monitoring rule, or the escalation contact has not accepted their notification subscription.
Fix: Verify the escalation policy is linked to the monitoring rule under the Business Application settings. Confirm the escalation contact's notification preferences are active.
Schedule automation job is not running at the configured time.
Cause: The schedule job may be paused, or the service principal used for automation may have lost the required permissions on the target resource group.
Fix: Check the job status in the Automation section of Cost Analyzer. Verify the service principal has Contributor access to the target resource group in Azure.
SSO login is failing for new users.
Cause: The user's identity provider account may not match the email address registered in Turbo360, or the SSO configuration may have a domain mismatch.
Fix: Confirm the user's UPN in the identity provider matches their Turbo360 invitation email. Review the SSO configuration in Authentication & SSO and verify the allowed domain list.

FAQs

Do these best practices apply to all Turbo360 modules?
Yes. The practices in this article cover Cost Analyzer, Business Applications, BAM, and Azure Documenter where applicable. Module-specific best practices articles are available under each module's Best Practices category.
How often should we review our Turbo360 configuration?
Perform a full configuration review quarterly. In addition, review monitoring thresholds and access policies after any significant change to your Azure environment, such as a new subscription, a major deployment, or a team restructuring.
Where can I find module-specific best practices?
Each module has a dedicated Best Practices category in the Turbo360 documentation. Navigate to the relevant module section for guidance specific to Cost Analyzer, Business Applications, BAM, or Azure Documenter.