Overview
Security best practices in Turbo360 are a set of recommended configurations and operational patterns that reduce your organization's attack surface, enforce least-privilege access, and maintain a defensible posture across all connected Azure subscriptions.
Business value
Following these practices reduces the risk of unauthorized access, data exposure, and privilege escalation. They give your security and operations teams a consistent baseline to audit against, and they align Turbo360 configuration with enterprise governance requirements.
How it works
Turbo360's security posture is built across four areas: identity and authentication, role-based access control (RBAC), service principal governance, and audit visibility. Each area has specific recommended configurations.
1. Identity and authentication
- Enable single sign-on (SSO) via Microsoft Entra ID for all users. Avoid email-based authentication in production environments.
- Enforce multi-factor authentication (MFA) at the identity provider level. Turbo360 inherits MFA enforcement from Microsoft Entra ID when SSO is active.
- Disable or remove inactive user accounts promptly. Review user lists monthly or after team changes.
- Do not share credentials across users. Every individual accessing Turbo360 should authenticate with their own identity.
2. Role-based access control
- Apply the principle of least privilege. Assign users the minimum role required to perform their function.
- Use the built-in Reader role for users who only need to view data — do not assign Contributor or Admin roles by default.
- Assign the Admin role only to users who manage organization settings, user provisioning, or service principal configuration.
- Review role assignments quarterly. Remove roles that are no longer required.
- Use teams and role groups to manage permissions at scale rather than assigning roles individually.
3. Service principal governance
- Create dedicated service principals for each Azure subscription connected to Turbo360. Do not reuse service principals across tenants or organizations.
- Grant service principals only the permissions required for Turbo360's monitoring and cost analysis functions. See Service principal management for the minimum required permission set.
- Rotate service principal client secrets on a defined schedule — at minimum annually, or immediately after a suspected compromise.
- Monitor service principal expiry dates. Expired credentials cause subscription disconnection and monitoring gaps.
- Do not store service principal secrets in code repositories, shared documents, or communication tools.
4. Audit and visibility
- Enable and review user activity logs regularly to detect unauthorized changes. Log review should be part of your standard security operations cadence.
- Export user log data to an external SIEM or storage account for long-term retention if your compliance policy requires it.
5. Network and private hosting
- For organizations using private hosting, restrict inbound access to Turbo360 infrastructure using VNet configuration and network security groups.
- Do not expose the Turbo360 management interface to the public internet without an application gateway or equivalent ingress control.
- Review private hosting network configuration after any Azure subscription or VNet change.