---
title: "Security best practices"
slug: "security-best-practices"
updated: 2026-09-18T05:57:01Z
published: 2026-09-18T05:57:01Z
canonical: "docs.turbo360.com/security-best-practices"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security best practices

## Overview

Security best practices in Turbo360 are a set of recommended configurations and operational patterns that reduce your organization's attack surface, enforce least-privilege access, and maintain a defensible posture across all connected Azure subscriptions.

### Business value

Following these practices reduces the risk of unauthorized access, data exposure, and privilege escalation. They give your security and operations teams a consistent baseline to audit against, and they align Turbo360 configuration with enterprise governance requirements.

## How it works

Turbo360's security posture is built across four areas: identity and authentication, role-based access control (RBAC), service principal governance, and audit visibility. Each area has specific recommended configurations.

### 1. Identity and authentication

- Enable single sign-on (SSO) via Microsoft Entra ID for all users. Avoid email-based authentication in production environments.
- Enforce multi-factor authentication (MFA) at the identity provider level. Turbo360 inherits MFA enforcement from Microsoft Entra ID when SSO is active.
- Disable or remove inactive user accounts promptly. Review user lists monthly or after team changes.
- Do not share credentials across users. Every individual accessing Turbo360 should authenticate with their own identity.

### 2. Role-based access control

- Apply the principle of least privilege. Assign users the minimum role required to perform their function.
- Use the built-in **Reader** role for users who only need to view data. Do not assign **Contributor** or **Admin** roles by default.
- Assign the **Admin** role only to users who manage organization settings, user provisioning, or service principal configuration.
- Review role assignments quarterly. Remove roles that are no longer required.
- Use teams and role groups to manage permissions at scale rather than assigning roles individually.

### 3. Service principal governance

- Create dedicated service principals for each Azure subscription connected to Turbo360. Do not reuse service principals across tenants or organizations.
- Grant service principals only the permissions required for Turbo360's monitoring and cost analysis functions. See [Service principal management](https://docs.turbo360.com/docs/service-principal-management-4) for the minimum required permission set.
- Rotate service principal client secrets on a defined schedule: at minimum annually, or immediately after a suspected compromise.
- Monitor service principal expiry dates. Expired credentials cause subscription disconnection and monitoring gaps.
- Do not store service principal secrets in code repositories, shared documents, or communication tools.

### 4. Audit and visibility

- Enable and review user activity logs regularly to detect unauthorized changes. Log review should be part of your standard security operations cadence.
- Export user log data to an external SIEM or storage account for long-term retention if your compliance policy requires it.

### 5. Network and private hosting

- For organizations using private hosting, restrict inbound access to Turbo360 infrastructure using VNet configuration and network security groups.
- Do not expose the Turbo360 management interface to the public internet without an application gateway or equivalent ingress control.
- Review private hosting network configuration after any Azure subscription or VNet change.

## Related articles

- [Access control](https://docs.turbo360.com/docs/access-control)
- [Data protection](https://docs.turbo360.com/docs/data-protection)
- [Service principal management](https://docs.turbo360.com/docs/service-principal-management-4)
- [Managing users - Microsoft Entra ID](https://docs.turbo360.com/docs/managing-users-in-microsoft-entra-id)
- [Entra ID SSO overview](https://docs.turbo360.com/docs/entra-id-sso-overview)