Overview
Before setting up Azure Documenter, confirm you have a Turbo360 account, the required Azure access, and the requirements for your chosen publish format.
Business value
- Avoid setup delays by confirming access and requirements upfront
- Choose the right publish format (file-based or online) before starting configuration
Prerequisites
Account requirements
An active account with Turbo360. Sign up for a new Turbo360 account.
Azure access requirements
A Service principal in Microsoft Entra ID with Reader access to the Azure subscription for which documentation is required. Reader is the minimum required for most document types. Some document types require additional Azure RBAC roles or Microsoft Graph API Application permissions on the app registration.
To learn how to authorize a Service principal for an Azure subscription and configure it with Azure Documenter, see Managing service principals in Azure Documenter. To manage service principals centrally across all Turbo360 modules, see Service principal management.
Azure RBAC requirements per document type
Reader access on the target subscription is the baseline requirement. Some document types need additional Azure roles assigned to the Service principal on each target subscription (or at a higher scope).
| Document type | Minimum Azure RBAC |
|---|---|
| Executive summary | Reader + Cost Management Reader |
| Resource details | Reader |
| Billing details | Reader + Cost Management Reader |
| Security compliance | Reader |
| Cost comparison | Reader + Cost Management Reader |
| Resource auditing | Reader + Monitoring Reader (Activity Log + Change Analysis) |
| Access details - By subscription | Reader |
| Access details - By type | Reader |
| Rightsizing recommendations | Reader |
| Reservation recommendations | Reader at reservation/billing scope + Microsoft.Capacity/reservations and Microsoft.Consumption/reservationDetails actions |
| Carbon summary | Reader |
| Carbon optimizations | Reader + Microsoft.Carbon/carbonEmissionReports action (via Advisor recommendations on Resource Graph) |
| License consumption | Reader (no ARM RBAC needed, Graph-only) |
| License optimizations | Reader (no ARM RBAC needed, Graph-only) |
| Service plan matrix | Reader (no ARM RBAC needed, Graph-only) |
Practical recommendation: Assign Reader + Cost Management Reader at subscription scope to cover every document type except Reservation recommendations, which may additionally require billing/reservation scope.
Microsoft Graph API permissions (Microsoft 365 document types)
The three Microsoft 365 document types (License consumption, License optimizations, Service plan matrix) require the following Application permissions on the app registration in Microsoft Entra ID, in addition to the Azure RBAC roles above:
| Permission | Purpose |
|---|---|
Organization.Read.All |
Retrieve organization-level license and tenant details |
User.Read.All |
Read user profiles and their assigned licenses |
Tenant-wide admin consent must be granted for both permissions by an administrator in the Azure portal before generating any of these document types.
Azure RBAC requirements for Diagrams
The Diagrams feature uses the same Service principal as Documentation but requires read access to additional Azure resource types depending on the diagram type generated.
| Diagram type | Minimum Azure RBAC |
|---|---|
| Network | Reader + exportTemplate on resource groups |
| Workload | Reader |
| Resource visualizer | Reader + Azure Resource Graph query access |
Publish format requirements
Azure Documenter supports three file formats plus online publishing:
- PDF: a portable file type for reliably presenting and exchanging documents
- Word: an editable, formattable document file type
- Excel: a format suited to data visualization and analysis of large volumes of data
For file-based formats, Azure Documenter uses a built-in storage account by default, or you can provide a connection string for your own Azure Storage account. To publish online, you need a Document360 project, its API token with all request methods enabled (GET/POST/PUT/DELETE), and your Azure Documenter user email added as a project member.
How it works
When you generate a document, Azure Documenter authenticates to your Azure subscription using the Service principal credentials you provide. It pulls resource inventory and cost data from Azure, then assembles the output into the configured format and publish destination. For file-based formats, Azure Documenter writes the output to the configured storage account. For online publishing, Azure Documenter pushes the output to the connected Document360 project using the API token you supply.
Troubleshooting
-
Service principal validation fails during document creation
Cause: the Service principal does not have Reader access to the target Azure subscription, or the client secret has expired.
Fix: verify that the Service principal has Reader access in the Azure portal and that the client secret is current. See Managing service principals in Azure Documenter for steps to update the secret. -
Online publish fails with an authentication error
Cause: the Document360 API token does not have all request methods (GET/POST/PUT/DELETE) enabled, or the user email has not been added as a project member.
Fix: regenerate the API token with all methods enabled and confirm the user email is listed as a project member in Document360. -
File-based document is not appearing in storage
Cause: the Azure Storage connection string is incorrect or the storage account is inaccessible from Turbo360.
Fix: verify the connection string and confirm the storage account allows access from Turbo360. Alternatively, use Turbo360's built-in storage account as a fallback.