Service principal management

Overview

Service principal management in Turbo360 gives you a central place to add, update, and remove service principals across all modules. Service principals added in one module are available to other modules, reducing duplication and making credential management easier.

Business value

Centralizing service principal management in Settings means you configure Azure credentials once and reuse them across Business Applications, Business Activity Monitoring, and Azure Documenter. Expiry alerts help you stay ahead of credential failures before they affect your integrations.

Prerequisites

• A Turbo360 account with Account owner access
• A valid Azure service principal with Client ID, Client secret, and Microsoft Entra ID (tenant ID)

Required permissions

Only users with the Account owner role can access Settings > Service principals.

Dependencies

• Microsoft Azure subscription with a configured service principal

How it works

Service principals are stored centrally under Settings > Service principals. Any service principal you add here is available for selection when configuring connections in Business Applications, Business Activity Monitoring, Cost Analyzer and Azure Documenter.

When you set a client secret expiry date, Turbo360 sends an alert notification 7 days before the secret expires, giving you time to rotate it without disrupting connected modules.

Turbo360 supports service principals from multiple Azure tenants. You can add service principals with different Microsoft Entra IDs, allowing you to connect resources and subscriptions across tenant boundaries within the same Turbo360 organization.

Steps

Use the following steps to add, edit, delete, and configure expiry alerts for service principals. Navigate to Settings > Service principals to get started.

Add a service principal

Adding a service principal registers your Azure credentials in Turbo360 and makes them available across all supported modules.

1. Click Add.
2. Enter values for Friendly name, Client Id, Client secret, Microsoft Entra ID, and Client secret expiry date.
3. Click Validate, then click Add.

Edit a service principal

Editing lets you update the friendly name, rotate the client secret, or extend the expiry date without deleting and re-adding the entry.

1. Click the Edit icon next to the service principal you want to update.
2. Update the Friendly name, Client secret, or Client secret expiry date as needed.
3. Click Validate, then click Update.

Delete a service principal

1. Click the Delete icon next to the service principal you want to remove.
2. Review the warning and click Delete in the confirmation dialog.

Configure expiry alerts

Expiry alerts notify you 7 days before a client secret expires so you can rotate it before any module loses connectivity. You set the expiry date when adding or editing a service principal.

1. Click Configure alert.
2. Select the service principals you want to monitor, then click Next.
3. Configure the notification channel and recipient email address.
4. Click Update.

Configuration

Permission behavior

With Account owner access: You can add, edit, delete, and configure expiry alerts for service principals. Added service principals are available across all supported modules.

Without Account owner access: The Settings > Service principals option is not accessible. Only Account owners can manage service principals.

Example scenario

Your organization uses Business Applications and Azure Documenter. You add a single service principal in Settings > Service principals with a client secret expiry date set 12 months from today. Both modules can now reference the same credential. When the secret is 7 days from expiry, Turbo360 sends an alert to your configured recipient, prompting you to rotate the secret before any module loses connectivity.

Limitations

• Only the Friendly name, Client secret, and Client secret expiry date can be updated after a service principal is created. The Client Id and Microsoft Entra ID cannot be changed; delete and re-add the service principal if these values need to change.
• Deleting a service principal immediately breaks its connection with Turbo360. There is no automatic re-association after deletion.
• Each service principal is tied to a single Azure tenant. To connect resources across multiple tenants, add a separate service principal for each tenant.

Troubleshooting

1. Validation fails when adding a service principal.
   Cause: The Client Id, Client secret, or Microsoft Entra ID may be incorrect or the service principal may lack the required Azure permissions.
   Fix: Verify each value in the Azure portal and ensure the service principal has the necessary role assignments.

2. Service principal is not visible in a module's Service principals settings.
   Cause: The page may be showing cached data.
   Fix: Refresh the page and check the Service principals settings again.

3. Expiry alert was not received.
   Cause: The notification channel or recipient email address may be misconfigured.
   Fix: Go to Settings > Service principals, click Configure alert, and verify the channel and recipient settings.

4. Client secret has expired and modules are failing.
   Cause: The client secret reached its expiry date without being rotated.
   Fix: Rotate the secret in the Azure portal, then edit the service principal in Settings > Service principals to update the Client secret and reset the Client secret expiry date.

5. Module lost connectivity after a service principal was deleted.
   Cause: Deletion permanently breaks the Turbo360 connection for that service principal.
   Fix: Re-add the service principal under Settings > Service principals and reconfigure the affected module to use the new entry.

FAQs

1. Can I use the same service principal across multiple modules?
   Yes. Any service principal added in Settings > Service principals is available to Business Applications, Business Activity Monitoring, Cost Analyzer and Azure Documenter.

2. How far in advance does Turbo360 send expiry alerts?
   Turbo360 sends the alert 7 days before the client secret expiry date you configured.

3. Can I update the Client Id or Microsoft Entra ID of an existing service principal?
   No. Only the Friendly name, Client secret, and Client secret expiry date are editable. Delete and re-add the service principal to change the Client Id or Microsoft Entra ID.

Related articles

• Managing service principals in Business Applications
• Bring your own backend
• Managing service principals in Azure Documenter
• Managing service principals in Cost Analyzer