Documentation Index

Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt

Use this file to discover all available pages before exploring further.

Managing service principals

  • 5 minute(s) read
Prev Next

Overview

Service principals in Business Activity Monitoring (BAM) connect Turbo360 to your Azure subscriptions and control which Business Process groups each principal can access. You add, update, and remove service principals from the Service principals section in BAM settings. Scope automation reduces the ongoing maintenance of subscription access by applying rules that automatically assign new subscriptions to the correct groups.

Business value

Centralized service principal management in BAM eliminates the manual overhead of updating subscription access every time your Azure estate changes. Scope automation ensures new subscriptions are included in the right monitoring groups immediately, reducing the risk of coverage gaps that go unnoticed until a tracking failure surfaces.

Prerequisites

Before managing service principals, confirm the following:

  • You have access to the Service principals section in BAM settings.
  • You have the Tenant ID, Client ID, and Client Secret expiration date for any new service principal you intend to add.
  • You have identified the Business Process groups to which the service principal requires access.

Required permissions

You must hold the Account owner role in Turbo360 to add, update, or remove service principals, or to configure scope automation rules.

How it works

Service principals authenticate Turbo360 against your Azure subscriptions using the OAuth 2.0 client credentials flow. Each service principal is validated against Azure before it is saved. After validation, you assign the service principal to one or more Business Process groups by configuring an access policy — specifying which subscriptions the principal can access and at what scope.

Scope automation extends this model by letting you define rules that match subscriptions by name. When Business Activity Monitoring runs its daily automation at 12:00 AM UTC, it evaluates all subscriptions within the service principal against your rules and updates access policies automatically. This means new subscriptions that match a rule gain access without requiring manual intervention.

Service principal scoping for a business process also lets you select the desired Azure data source from the supported resources available within the configured subscription. This determines which Azure resource the data query runs against when tracking transactions in that business process.

Service principals operate exclusively within the Data Queries type of tracking.

Steps

Use the following steps to add, update, and remove service principals, and to configure scope automation rules. Navigate to Business Activity Monitoring > Service principals to get started.

Add a service principal

Adding a service principal registers a new Azure identity in BAM and defines which Business Process groups it can access.

  1. Click Add in the Service principals section.
  2. Select an existing service principal from the list, or clear the checkbox to add a new one.
  3. Enter a name and provide the subscription details: Tenant ID, Client ID, and Client secret expiration date.
  4. Click Validate.
  5. After successful validation, click Next.
  6. Choose the desired subscription and configure the scope to the selected Business Process groups.
  7. Click Save.

Update a service principal

Updating a service principal lets you refresh the client secret or modify the access policy for existing Business Process groups.

  1. Click the Edit icon next to the service principal you want to update.
  2. Modify the Client secret or Client secret expiration date as needed.
  3. Click Validate.
  4. After successful validation, click Next.
  5. Update the access policy for the relevant Business Process groups.
  6. Click Update.

Configure scope automation

Scope automation removes the need to manually update access policies when new Azure subscriptions are added to a service principal. Rules run daily at 12:00 AM UTC and apply access policies to all matching subscriptions. By scoping subscriptions that match a particular criteria to a Business Process group, scope automation makes those subscriptions available as selectable data sources when you configure queries within that group.

  1. Go to Service principals and Add or Edit the service principal you want to automate.
  2. Validate the credentials and proceed to the Access policy screen.
  3. To grant root-level access to all new and existing subscriptions within the service principal automatically, enable the toggle: Apply the access policy across all new and existing subscriptions within the service principal.
  4. To define condition-based rules, click Configure rule > Add rule.
  5. Define a condition (for example, subscription name contains a specific string) and configure the scope to the target Business Process groups. Any new or existing subscription that meets the condition gains access to the configured scopes automatically.
  6. Click Save.
  7. Click Update > Continue in the confirmation dialog to finalise the automation rules.

Remove a service principal

Removing a service principal revokes its access to all associated Business Process groups and deletes it from BAM.

  1. Click the Delete icon next to the service principal you want to remove.
  2. Click Delete in the confirmation dialog.

Limitations

  • Service principal management is available only for the Data Queries type of tracking. Custom Logging type deployments do not support service principal configuration from this screen.
  • Scope automation runs once daily at 12:00 AM UTC. Subscription access changes made between automation runs are not applied until the next scheduled run.
  • Only one set of automation rules can be configured per service principal.

Troubleshooting

  1. Validation fails when adding a new service principal
    Cause: The Tenant ID, Client ID, or Client Secret provided is incorrect, expired, or the service principal does not have the required permissions in Azure.
    Fix: Verify the credentials in the Azure portal. Confirm the service principal has the required API permissions and that the Client Secret has not expired. Re-enter the correct values and retry validation.

  2. Scope automation does not apply access to a new subscription
    Cause: The new subscription name does not match any configured automation rule, or the automation has not yet run since the subscription was added.
    Fix: Review the automation rules on the Access policy screen and confirm the subscription name satisfies at least one rule condition. If the rule is correct, wait until the next daily run at 12:00 AM UTC or manually add the subscription in the access policy.

  3. Service principal appears in the list but cannot access any Business Process groups
    Cause: The access policy was not configured or was saved without assigning any Business Process groups.
    Fix: Click the Edit icon next to the service principal, proceed to the Access policy step, select the required subscriptions and Business Process groups, and save.

  4. Client secret expiration date was not updated after secret rotation
    Cause: The service principal was updated in Azure but the expiration date was not updated in BAM.
    Fix: Edit the service principal in BAM, update the Client secret and Client secret expiration date fields with the new values, validate, and save.

  5. Delete icon is not available for a service principal
    Cause: The signed-in user does not hold the Account owner role in Turbo360.
    Fix: Request an Account owner to remove the service principal, or contact your organization administrator to have the Account owner role assigned to your account.

Related articles