Architecture overview

Overview

This article describes how Turbo360 is architecturally structured — how it connects to Azure, how data flows through the platform, and how the four modules relate to the underlying infrastructure.

Business value

Understanding the architecture helps administrators plan deployments, configure service principals correctly, and troubleshoot connectivity or data issues with confidence.

Prerequisites

• Familiarity with Azure service principals and RBAC
• A Turbo360 account (for context when reviewing connectivity)

Required permissions

No specific permissions required to read this article.

Dependencies

• Azure subscription
• Azure service principal with appropriate roles (varies by module)

How it works

Connectivity model

Turbo360 connects to Azure through service principals registered in your Azure Active Directory (Microsoft Entra ID) tenant. Each service principal acts as an identity Turbo360 uses to read data from your Azure subscriptions.

You register the service principal in Azure, assign it the required roles on your subscriptions, and then provide the credentials to Turbo360 during subscription setup. Turbo360 does not require write access for most operations; read permissions are sufficient for Cost Analyzer, Business Applications monitoring, and Azure Documenter. BAM data ingestion uses a push model where your integrations send data to Turbo360's API — no inbound Azure access is required for that flow.

Data flow

Each module follows a distinct data flow pattern:

Cost Analyzer pulls billing and resource data from Azure Cost Management APIs on a scheduled import cycle. Imported data is stored in Turbo360 and made available for analysis, budgeting, and reporting.

Business Applications queries Azure resource metadata and health signals at regular intervals. Monitoring rules evaluate the collected data and generate alerts when conditions are met.

Business Activity Monitoring operates in two modes. In push mode, your integrations send transaction events to Turbo360's BAM API. In pull mode, Turbo360 queries supported Azure data sources (Application Insights, Log Analytics, and others) to retrieve transaction data.

Azure Documenter generates documentation on demand or on a schedule by querying Azure Resource Manager and other Azure APIs for subscription and resource metadata.

Module isolation

Each module is independently deployed and configured. Enabling or disabling one module has no effect on the others. Data collected by one module is not shared with or visible from another.

Authentication and access control

Turbo360 uses role-based access control (RBAC) to manage user permissions within the platform. Roles are assigned at the organization level and can be scoped per module. Azure-side permissions are managed separately through service principal role assignments in Azure.

Configuration

Permission behavior

With access: Administrators can view and modify architecture-level settings including service principal configuration and subscription connections.

Without access: Non-administrator users cannot modify connectivity settings but can use modules within the permissions of their assigned role.

Example scenario

An organization connects three Azure subscriptions to Turbo360 using separate service principals — one per subscription with Reader and Cost Management Reader roles. Their integration platform sends BAM events via the push API, while Azure Documenter queries subscription metadata using the same service principal. All four modules operate from a single Turbo360 organization.

Limitations

• Turbo360 Private hosting is limited to the following Azure Environments: Azure Global Cloud, Azure China Cloud, Azure US Government.
• One service principal can be shared across multiple subscriptions, but permissions and scopes must be explicitly assigned on each subscription.

Troubleshooting

1. Subscription data is not loading after service principal setup.
   Cause: The service principal may not have been assigned the required role on the subscription.
   Fix: In the Azure portal, assign the Reader role (and Cost Management Reader for Cost Analyzer) to the service principal at the subscription scope.

2. BAM push events are not appearing in the platform.
   Cause: The API endpoint URL or authentication token used in the integration is incorrect.
   Fix: Retrieve the correct endpoint and credentials from the BAM settings in Turbo360 and update your integration.

3. Azure Documenter cannot access subscription resources.
   Cause: The service principal's client secret may have expired.
   Fix: Generate a new client secret in Azure and update it in Turbo360's subscription settings.

4. Cost data is delayed by more than expected.
   Cause: Azure Cost Management API data has a known processing lag of 24–48 hours.
   Fix: This is expected Azure behavior. Turbo360 imports data as soon as Azure makes it available.

5. Service principal authentication fails after tenant migration.
   Cause: The tenant ID recorded in Turbo360 no longer matches the Azure tenant.
   Fix: Update the tenant ID in the subscription settings in Turbo360 and re-authenticate.

FAQs

1. Does Turbo360 require any resources to be deployed in my Azure subscription?
   For most modules, no deployment is required — Turbo360 reads data remotely via service principal. BAM with bring-your-own-backend requires a deployment. See the BAM Getting Started guide for details.

2. Can I use the same service principal for all four modules?
   Yes, as long as the service principal has all required permissions for each module. You may also use separate service principals per module or per subscription for tighter access control.

3. Is data transmitted from Azure to Turbo360 encrypted?
   Turbo360 ensures that data is encrypted at rest as well as in transit.

Related articles

• What is Turbo360?
• Product overview
• Key capabilities
• Connect Azure subscription