Prerequisites

Overview

Before using Cost Analyzer, ensure your Turbo360 account is active and your Azure environment is ready. You'll need an Azure App Registration (service principal) in Microsoft Entra ID with the correct permissions and credentials in place before starting setup.

Business value

Setting up prerequisites before you begin prevents access failures and wasted setup time. It ensures Cost Analyzer can start pulling billing data immediately, with reservation and optimization recommendations available from day one.

Prerequisites

Turbo360 account

An active Turbo360 account is required before you can configure Cost Analyzer or connect any Azure subscriptions.

Azure App Registration

You need an Azure App Registration (service principal) created in Microsoft Entra ID with the following values available before starting setup:

• Tenant ID: Directory (tenant) ID from Microsoft Entra ID
• Client ID: Application (client) ID of the registered app
• Client secret: a valid, unexpired secret for the app registration

Required permissions

The service principal must be assigned both roles at the subscription scope for each Azure subscription you want to analyze:

Azure portal redirect permissions

Redirecting to the Azure portal from any reservation recommendation requires the following Microsoft Graph application permissions to be granted on the app registration:

• Directory.Read.All
• Domain.Read.All

Ensure both permissions are granted with admin consent in the associated Microsoft Entra ID app registration. In the Azure portal, open the app registration, go to API permissions, and confirm admin consent is shown for both permissions.

How it works

Cost Analyzer uses a service principal registered in Microsoft Entra ID to authenticate with the Azure Management API and retrieve billing data. You need the Tenant ID, Client ID, and Client secret ready before starting setup.

Checklist

Before proceeding to Initial setup, confirm the following:

• Active Turbo360 account
• Active Azure subscription(s) to connect
• App Registration created in Microsoft Entra ID
• Reader access assigned at the subscription scope
• Reservation Reader access assigned at the subscription scope
• Tenant ID, Client ID, and Client secret noted and saved

Troubleshooting

1. No access to create an App Registration
   Cause: Requires the Application Administrator or Global Administrator role in Microsoft Entra ID.
   Fix: Contact your Azure administrator.

2. Can't assign Reader access to the subscription
   Cause: Requires the Owner or User Access Administrator role on the subscription.
   Fix: Contact your subscription owner.

3. Client secret has expired
   Cause: The secret generated at App Registration time has passed its expiry date.
   Fix: Generate a new secret under Certificates & secrets in the App Registration, then update the service principal in Turbo360.

4. Multiple subscriptions: do I need a separate service principal for each?
   No. Assign Reader access to a single service principal on each subscription you want to analyze.

FAQs

1. Can I use an existing App Registration?
   Yes, if it already has the required permissions. You'll need the Tenant ID, Client ID, and a valid Client secret.

2. How many subscriptions can I connect?
   Multiple. Each subscription must have the service principal assigned Reader access individually.

3. Is Reservation Reader always required?
   Only if you want reservation-based recommendations in Optimization. It can be skipped if you have no reservations.

4. What if the client secret expires after setup?
   Cost Analyzer will stop syncing. Generate a new secret in Azure and update the service principal in Turbo360.

Related articles

• What is a service principal?
• Initial setup
• Service principal management
• What is Cost Analyzer?