--- title: "Permission requirements for Turbo360" slug: "permission-requirements-for-turbo360" updated: 2026-10-29T11:13:41Z published: 2026-10-29T11:13:41Z canonical: "docs.turbo360.com/permission-requirements-for-turbo360" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt > Use this file to discover all available pages before exploring further. # Permission requirements for Turbo360 ## Overview Turbo360 accesses your Azure subscription using a service principal. Turbo360 has five modules. For each of the four that connect to Azure subscriptions, the service principal must have specific Azure RBAC roles assigned on the target subscription. Tenant Manager connects to Microsoft 365 tenants instead. It does not use Azure roles and needs Microsoft Graph application permissions. This article lists the required permissions for each of those four modules and explains how to assign them. ### Business value Configuring the minimum required permissions for your service principal reduces the attack surface of your Turbo360 integration. Granting only the roles each module needs ensures that Turbo360 operates under the principle of least privilege, which simplifies compliance auditing and access reviews. ## Prerequisites Before configuring permissions, make sure you have: - A service principal registered in Microsoft Entra ID and added to Turbo360 - An Azure subscription connected to Turbo360 - Owner access on the target Azure subscription (required to assign RBAC roles) ### Required permissions | Permission | Details | | --- | --- | | Azure role | Owner on the target Azure subscription (to assign roles to the service principal) | | Turbo360 role | Account owner | ### Dependencies - Microsoft Azure subscription - Service principal registered in Microsoft Entra ID - Azure RBAC role assignment capability on the target subscription ## How it works Azure RBAC (role-based access control) controls what the service principal can read or manage on your subscription. Turbo360 modules use the service principal's permissions to retrieve cost data, resource metadata, monitoring data, and documentation inputs. You assign roles to the service principal at the **subscription scope** in the Azure portal under **Access control (IAM)**. Each role you assign applies to all resources within that subscription. If you want to restrict access to specific resource groups, you can assign roles at the resource group scope instead, but this may limit module functionality. ## Steps Use the following steps to assign an Azure RBAC role to your service principal. Open the Azure portal and navigate to **Subscriptions** to get started. ### Assign an Azure role to the service principal Assigning a role at the subscription scope grants the service principal the access it needs for each Turbo360 module. 1. Select the target subscription. 2. Click **Access control (IAM)**. 3. Click **Add > Add role assignment**. 4. On the **Role** tab, search for and select the required role (see the configuration table below for the role required by each module). 5. Click **Next**. 6. On the **Members** tab, click **Select members** and search for your service principal by name or client ID. 7. Select the principal and click **Select**. 8. Click **Review + assign**, then click **Review + assign** again to confirm. Repeat for each role required by the modules you plan to use. ## Configuration ### Required Azure roles by module | Module | Minimum required role | Notes | | --- | --- | --- | | Cost Analyzer | Reader + Billing Reader | Reader for resource data; Billing Reader for cost and usage data | | Business Applications | Reader | Read access to resource groups and resources | | Business Activity Monitoring | Reader | Read access to Logic Apps, Service Bus, and related resources | | Azure Documenter | Reader | Read access to subscription resources and metadata | Note: If you use multiple modules, assign all required roles to the service principal. Roles are additive: assigning Reader and Billing Reader grants both sets of permissions. Note: Tenant Manager does not use Azure roles. It connects to Microsoft 365 tenants and needs Microsoft Graph application permissions, which your Microsoft Entra administrator grants with admin consent. For details, see [Connect a Microsoft 365 tenant](https://docs.turbo360.com/docs/connect-a-microsoft-365-tenant). ### Role descriptions | Role | Description | | --- | --- | | Reader | Read-only access to all resources in the subscription. Does not allow viewing cost or billing data. | | Billing Reader | Read-only access to billing, cost, and usage data for the subscription. Required for Cost Analyzer. | ## Permission behavior **With required roles assigned:** Turbo360 modules can retrieve resource data, cost data, and monitoring information from the subscription. All module features operate as expected. **With insufficient roles:** Module dashboards may show incomplete data or errors. Cost Analyzer will not display cost or usage data if Billing Reader is missing. Other modules will not display resource data if Reader is missing. No write operations are performed on your Azure resources. **Without any roles assigned:** The subscription connection will validate successfully (credentials are correct) but modules will return no data. Assign the required roles and allow a few minutes for the initial data sync. ## Example scenario Your organization connects a production subscription to Turbo360 to use Cost Analyzer and Business Applications. You assign the **Reader** role and the **Billing Reader** role to the service principal on the production subscription. Cost Analyzer can now retrieve cost and usage data, and Business Applications can discover and monitor resource groups. When you later onboard Business Activity Monitoring, no additional role assignment is needed because Reader already covers that module's requirements. ## Limitations - Role assignments apply to the entire subscription scope unless you manually assign at a lower scope (resource group or resource). Narrower scopes may reduce module functionality. - Turbo360 does not perform write operations on Azure resources using the service principal. All access is read-only for standard module usage. - Changes to role assignments in Azure may take a few minutes to propagate before Turbo360 reflects updated access. ## Troubleshooting 1. **Cost Analyzer shows no cost or usage data.** Cause: The service principal is likely missing the Billing Reader role. Fix: In the Azure portal, go to **Access control (IAM)** on the subscription, confirm the Billing Reader role is assigned to the principal, and add it if missing. 2. **Business Applications or BAM shows no resources.** Cause: The Reader role may not be assigned on the subscription. Fix: Verify role assignments under **Access control (IAM)** in the Azure portal. 3. **Role was assigned but data is still missing in Turbo360.** Cause: Azure RBAC changes can take a few minutes to propagate. Fix: Wait 5-10 minutes and refresh the Turbo360 application. If data is still missing, verify the correct service principal is connected in Turbo360 under **Settings > Service principals**. 4. **Cannot assign a role because the Add role assignment option is greyed out.** Cause: You do not have Owner access on the subscription. Fix: Contact your Azure subscription owner to assign the required roles to the service principal. 5. **Service principal validation passes but modules report an access error.** Cause: The service principal credentials are valid but the principal lacks the required roles. Fix: Assign the roles listed in the configuration table above, then allow a few minutes for the changes to propagate. ## FAQs 1. **Can I assign roles at the resource group level instead of the subscription level?** Yes, but this may limit module functionality. Turbo360 modules are designed to operate at the subscription scope. Assigning roles at the resource group level restricts visibility to only those resource groups and may cause incomplete data in the Turbo360 application. 2. **Do I need to re-assign roles if I rotate the client secret?** No. Azure RBAC roles are assigned to the service principal identity (the app registration), not to the client secret. Rotating the secret does not affect role assignments. 3. **What is the minimum role required to use all modules that connect to Azure subscriptions?** Assign both **Reader** and **Billing Reader** on the subscription. Reader covers resource access for all four of those modules; Billing Reader adds cost and usage data access required by Cost Analyzer. Tenant Manager does not use Azure roles. ## Related articles - [Service principal setup](https://docs.turbo360.com/docs/service-principal-setup) - [Connect Azure subscription](https://docs.turbo360.com/docs/connect-azure-subscription) - [Connect a Microsoft 365 tenant](https://docs.turbo360.com/docs/connect-a-microsoft-365-tenant) - [Assign Azure roles using the Azure portal](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal)