Service principal management

Overview

Service principal management in Turbo360 gives you a central place to add, update, and remove service principals across all modules. Service principals added in one module are available to other modules, reducing duplication and making credential management easier.

Business value

Centralizing service principal management in Settings means you configure credentials once and reuse them across Cost Analyzer, Business Applications, Business Activity Monitoring, Azure Documenter, and Tenant Manager. Expiry alerts help you stay ahead of credential failures before they affect your integrations.

Prerequisites

• A Turbo360 account with Account owner access
• A valid Azure service principal with Client ID, Client secret, and Microsoft Entra ID (tenant ID)

Required permissions

Only users with the Account owner role can access Settings > Service principals.

Dependencies

• Microsoft Azure subscription with a configured service principal

How it works

Service principals are stored centrally under Settings > Service principals. Any service principal you add here is available for selection when configuring connections in Business Applications, Business Activity Monitoring, Cost Analyzer and Azure Documenter.

When you set a client secret expiry date, Turbo360 sends an alert notification 7 days before the secret expires, giving you time to rotate it without disrupting connected modules.

Turbo360 supports service principals from multiple Azure tenants. You can add service principals with different Microsoft Entra IDs, allowing you to connect resources and subscriptions across tenant boundaries within the same Turbo360 organization.

Tenant Manager connects Microsoft 365 tenants with an app registration, and it shares service principals with the other modules in both directions. A service principal you add while connecting a tenant in Tenant Manager is listed here with the Tenant Manager icon, even if it has no Azure subscription. Service principals saved in other modules, with their client secret stored, can be selected when you connect a tenant in Tenant Manager. Service principals added in Tenant Manager can in turn be selected in the other modules.

Steps

Use the following steps to add, edit, delete, and configure expiry alerts for service principals. Navigate to Settings > Service principals to get started.

Add a service principal

Adding a service principal registers your Azure credentials in Turbo360 and makes them available across all supported modules.

1. Click Add.
2. Enter values for Friendly name, Client Id, Client secret, Microsoft Entra ID, and Client secret expiry date.
3. Click Validate, then click Add.

Edit a service principal

Editing lets you update the friendly name, rotate the client secret, or extend the expiry date without deleting and re-adding the entry.

1. Click the Edit icon next to the service principal you want to update.
2. Update the Friendly name, Client secret, or Client secret expiry date as needed.
3. Click Validate, then click Update.

The Edit icon is enabled for every service principal, including one that only Tenant Manager uses.

When a Tenant Manager tenant uses the service principal, the edit dialog lists the permissions Tenant Manager needs with their status. Tenant Manager checks a changed secret for these permissions when you click Validate and again when you click Update, and an edit that would drop Tenant Manager's permissions is refused. A refusal lists the missing permissions. If a permission is missing, the dialog says "Tenant Manager reads tenants through this service principal, and it does not have every permission Tenant Manager needs. Grant the missing permissions in the app registration, then validate again." If the permissions can't be confirmed, it says "Tenant Manager reads tenants through this service principal, and its permissions could not be confirmed." followed by the reason.

Delete a service principal

1. Click the Delete icon next to the service principal you want to remove.
2. Review the warning and click Delete in the confirmation dialog.

The Delete icon is disabled for a service principal that a Tenant Manager tenant uses. Hover over it to read "Used by Tenant Manager. Delete the tenants that use it in Tenant Manager first." If a delete is refused anyway, the message names the tenant, or the tenants, that use it. Delete them in Tenant Manager first. Deleting a tenant in Tenant Manager keeps its service principal here, so once no tenant uses a Tenant Manager service principal, you can select it for another tenant or delete it.

Configure expiry alerts

Expiry alerts notify you 7 days before a client secret expires so you can rotate it before any module loses connectivity. You set the expiry date when adding or editing a service principal.

1. Click Configure alert.
2. Select the service principals you want to monitor, then click Next.
3. Configure the notification channel and recipient email address.
4. Click Update.

Configuration

Permission behavior

With Account owner access: You can add, edit, delete, and configure expiry alerts for service principals. Added service principals are available across all supported modules.

Without Account owner access: The Settings > Service principals option is not accessible. Only Account owners can manage service principals.

Example scenario

Your organization uses Business Applications and Azure Documenter. You add a single service principal in Settings > Service principals with a client secret expiry date set 12 months from today. Both modules can now reference the same credential. When the secret is 7 days from expiry, Turbo360 sends an alert to your configured recipient, prompting you to rotate the secret before any module loses connectivity.

Limitations

• Only the Friendly name, Client secret, and Client secret expiry date can be updated after a service principal is created. The Client Id and Microsoft Entra ID cannot be changed; delete and re-add the service principal if these values need to change.
• Deleting a service principal immediately breaks its connection with Turbo360. There is no automatic re-association after deletion.
• Each service principal is tied to a single Azure tenant. To connect resources across multiple tenants, add a separate service principal for each tenant.
• No service principal can be deleted while a Tenant Manager tenant uses it.
• A new service principal is refused with the error A service principal already exists with the same client ID when the same client ID and directory are already stored, including when Tenant Manager stored them. Select the existing service principal instead of adding it again.

Troubleshooting

1. Validation fails when adding a service principal.
   Cause: The Client Id, Client secret, or Microsoft Entra ID may be incorrect or the service principal may lack the required Azure permissions.
   Fix: Verify each value in the Azure portal and ensure the service principal has the necessary role assignments.

2. Service principal is not visible in a module's Service principals settings.
   Cause: The page may be showing cached data.
   Fix: Refresh the page and check the Service principals settings again.

3. Expiry alert was not received.
   Cause: The notification channel or recipient email address may be misconfigured.
   Fix: Go to Settings > Service principals, click Configure alert, and verify the channel and recipient settings.

4. Client secret has expired and modules are failing.
   Cause: The client secret reached its expiry date without being rotated.
   Fix: Rotate the secret in the Azure portal, then edit the service principal in Settings > Service principals to update the Client secret and reset the Client secret expiry date.

5. Module lost connectivity after a service principal was deleted.
   Cause: Deletion permanently breaks the Turbo360 connection for that service principal.
   Fix: Re-add the service principal under Settings > Service principals and reconfigure the affected module to use the new entry. If the module says "That service principal is no longer stored. Choose another one, or add it again with its client secret.", choose another saved service principal or add it again.

FAQs

1. Can I use the same service principal across multiple modules?
   Yes. Any service principal added in Settings > Service principals is available to Business Applications, Business Activity Monitoring, Cost Analyzer and Azure Documenter. Tenant Manager can also use service principals that have a stored client secret when you connect a tenant.

2. How far in advance does Turbo360 send expiry alerts?
   Turbo360 sends the alert 7 days before the client secret expiry date you configured.

3. Can I update the Client Id or Microsoft Entra ID of an existing service principal?
   No. Only the Friendly name, Client secret, and Client secret expiry date are editable. Delete and re-add the service principal to change the Client Id or Microsoft Entra ID.

4. Why can't I delete a service principal that Tenant Manager uses?
   A service principal cannot be deleted while a Tenant Manager tenant uses it. Delete the tenants that use it in Tenant Manager first. You can still edit the service principal here.

Related articles

• Managing service principals in Business Applications
• Bring your own backend
• Managing service principals in Azure Documenter
• Managing service principals in Cost Analyzer
• Connect a Microsoft 365 tenant