--- title: "What is a service principal?" slug: "what-is-a-service-principal-1" updated: 2026-09-04T05:46:16Z published: 2026-09-04T05:46:16Z canonical: "docs.turbo360.com/what-is-a-service-principal-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt > Use this file to discover all available pages before exploring further. # What is a service principal? ## Overview A **service principal** is an application identity within **Microsoft Entra ID** that Turbo360 uses to access resources in your Azure environment. Access is restricted by the roles you assign to the service principal, so you control exactly which resources it can reach and at what level. To connect a service principal to Turbo360, you need three values: - **Microsoft Entra ID:** the tenant directory ID. - **Client ID:** the ID of the service principal object (the app registered with Microsoft Entra ID). - **Client Secret:** the application password. ### Business value A correctly configured service principal lets Turbo360 read and manage your Azure cost and resource data automatically, without relying on individual user credentials. This keeps access auditable, scoped, and easy to revoke if it's no longer needed. ## Prerequisites You need access to an Azure subscription and permissions to register applications in Microsoft Entra ID before you set up a service principal. ### Required permissions - **Reader** access at the subscription level is required for the service principal so Turbo360 can read your subscription's cost data. Without this, cost data won't be visible. - **Reservation Reader** access is required for the service principal to view reservations and reservation-based recommendations. ## How it works Setting up a service principal for Turbo360 involves three activities: - **Create a service principal** by registering an application in Microsoft Entra ID. - **Authorize** the service principal and **assign a role** to it at the subscription, resource group, or resource level. - Permissions are inherited to lower levels of scope. For example, a service principal with the **Contributor** or **Owner** role on a resource group can access that resource group and all resources it contains. ## Steps Use the following steps to create a service principal in Microsoft Entra ID, retrieve the values Turbo360 needs, and authorize it to access your subscription. Start in the Azure portal. ### Create a service principal Registering an application in Microsoft Entra ID creates the service principal identity that Turbo360 will use to access your Azure resources. 1. Navigate to the **Microsoft Entra ID** tab in the left side menu of the Azure portal and click **App registrations**. 2. Click the **New registration** button. 3. Provide a **Name** for the service principal. Select a supported account type to determine who can use the application. Under **Redirect URI**, select **Web** as the application type, and enter the URI the access token should be sent to. Click **Register**. 4. The new service principal appears in the **App Registration** grid. ### Get the Azure tenant ID The tenant ID identifies your organization's dedicated Microsoft Entra ID instance and is one of the three values Turbo360 needs to connect to the service principal. 1. Click the name of the service principal. 2. Copy the **Directory (tenant) ID** from the **Essentials** section; this is your Tenant ID. ### Get the client ID and client secret The client ID and client secret authenticate the service principal when it requests access tokens, and are required alongside the tenant ID to complete the Turbo360 connection. 1. Click the name of the service principal. 2. Copy the **Application (client) ID** from the **Essentials** section; this is a 16-character string that identifies the application. 3. Click **Certificates & secrets** under the **Manage** section in the left pane. 4. Click **New client secret**, provide a **Description** and **Expiry time**, and click **Add**. 5. Copy the client secret immediately after it's generated; it's shown only once. ### Authorize the service principal and assign a role Authorizing the service principal at the subscription level grants Turbo360 the access it needs to read cost data and reservation recommendations. 1. Navigate to the target **Subscription** and click **Access control (IAM)**. 2. Select **Add** > **Add role assignment**. 3. Switch to the **Job function roles** tab and choose **Reader**. 4. Click **Next**, then choose **User, group, or service principal** for the **Assign access to** field. 5. Select one or more service principals as **Members** to assign the role to them for this subscription. 6. Click **Review + assign** to save the role assignment. Role assignment changes can take some time to take effect. ## Troubleshooting 1. **Cost data is not appearing after connecting the service principal** Cause: The service principal may not have **Reader** access at the correct scope, or the role assignment has not yet propagated. Fix: Confirm **Reader** is assigned at the subscription scope in Azure portal > Access control (IAM). Role assignments can take several minutes to take effect — wait and retry before investigating further. 2. **Authentication fails when connecting the service principal to Turbo360** Cause: The tenant ID, client ID, or client secret entered in Turbo360 is incorrect, or the client secret has expired. Fix: Return to the app registration in Microsoft Entra ID and verify the **Directory (tenant) ID** and **Application (client) ID**. If the client secret has expired, generate a new one under **Certificates & secrets** and update it in Turbo360. 3. **Reservation recommendations are not appearing** Cause: The service principal is missing **Reservation Reader** access, which is separate from the subscription-level **Reader** role. Fix: Follow the Reservation Reader assignment steps in the [Permissions for service principal](https://docs.turbo360.com/docs/permissions-for-service-principal) article to add this role in the Azure portal. 4. **The client secret was not copied before navigating away** Cause: Azure displays the client secret value only once, immediately after generation. Navigating away before copying it makes it unrecoverable. Fix: Delete the expired or uncaptured secret under **Certificates & secrets** and generate a new one. Copy it immediately and store it securely before leaving the page. ## Related articles - [Managing service principals in Cost Analyzer](https://docs.turbo360.com/docs/managing-service-principals-in-cost-analyzer) - [Permissions for service principal](https://docs.turbo360.com/docs/permissions-for-service-principal) - [Additional service principal permissions](https://docs.turbo360.com/docs/additional-service-principal-permissions) Further reading To learn more about service principals, see the following Microsoft articles: - [Use portal to create an Azure Active Directory application and service principal that can access resources](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) - [Application and service principal objects in Microsoft Entra ID](https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals#service-principal-object) - [What are service principals and where do they come from?](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added#what-are-service-principals-and-where-do-they-come-from)