Permission requirements for Turbo360

Overview

Turbo360 accesses your Azure subscription using a service principal. For each module you use, the service principal must have specific Azure RBAC roles assigned on the target subscription. This article lists the required permissions for each Turbo360 module and explains how to assign them.

Business value

Configuring the minimum required permissions for your service principal reduces the attack surface of your Turbo360 integration. Granting only the roles each module needs ensures that Turbo360 operates under the principle of least privilege, which simplifies compliance auditing and access reviews.

Prerequisites

Before configuring permissions, make sure you have:

• A service principal registered in Microsoft Entra ID and added to Turbo360
• An Azure subscription connected to Turbo360
• Owner access on the target Azure subscription (required to assign RBAC roles)

Required permissions

Dependencies

• Microsoft Azure subscription
• Service principal registered in Microsoft Entra ID
• Azure RBAC role assignment capability on the target subscription

How it works

Azure RBAC (role-based access control) controls what the service principal can read or manage on your subscription. Turbo360 modules use the service principal's permissions to retrieve cost data, resource metadata, monitoring data, and documentation inputs.

You assign roles to the service principal at the subscription scope in the Azure portal under Access control (IAM). Each role you assign applies to all resources within that subscription. If you want to restrict access to specific resource groups, you can assign roles at the resource group scope instead, but this may limit module functionality.

Steps

Assign an Azure role to the service principal

1. In the Azure portal, go to Subscriptions and select the target subscription.
2. Click Access control (IAM).
3. Click Add > Add role assignment.
4. On the Role tab, search for and select the required role (see the configuration table below for the role required by each module).
5. Click Next.
6. On the Members tab, click Select members and search for your service principal by name or client ID.
7. Select the principal and click Select.
8. Click Review + assign, then click Review + assign again to confirm.

Repeat for each role required by the modules you plan to use.

Configuration

Required Azure roles by module

Role descriptions

Permission behavior

With required roles assigned: Turbo360 modules can retrieve resource data, cost data, and monitoring information from the subscription. All module features operate as expected.

With insufficient roles: Module dashboards may show incomplete data or errors. Cost Analyzer will not display cost or usage data if Billing Reader is missing. Other modules will not display resource data if Reader is missing. No write operations are performed on your Azure resources.

Without any roles assigned: The subscription connection will validate successfully (credentials are correct) but modules will return no data. Assign the required roles and allow a few minutes for the initial data sync.

Example scenario

Your organization connects a production subscription to Turbo360 to use Cost Analyzer and Business Applications. You assign the Reader role and the Billing Reader role to the service principal on the production subscription. Cost Analyzer can now retrieve cost and usage data, and Business Applications can discover and monitor resource groups. When you later onboard Business Activity Monitoring, no additional role assignment is needed because Reader already covers that module's requirements.

Limitations

• Role assignments apply to the entire subscription scope unless you manually assign at a lower scope (resource group or resource). Narrower scopes may reduce module functionality.
• Turbo360 does not perform write operations on Azure resources using the service principal — all access is read-only for standard module usage.
• Changes to role assignments in Azure may take a few minutes to propagate before Turbo360 reflects updated access.

Troubleshooting

1. Cost Analyzer shows no cost or usage data.
   Cause: The service principal is likely missing the Billing Reader role.
   Fix: In the Azure portal, go to Access control (IAM) on the subscription, confirm the Billing Reader role is assigned to the principal, and add it if missing.

2. Business Applications or BAM shows no resources.
   Cause: The Reader role may not be assigned on the subscription.
   Fix: Verify role assignments under Access control (IAM) in the Azure portal.

3. Role was assigned but data is still missing in Turbo360.
   Cause: Azure RBAC changes can take a few minutes to propagate.
   Fix: Wait 5–10 minutes and refresh the Turbo360 application. If data is still missing, verify the correct service principal is connected in Turbo360 under Settings > Service principals.

4. Cannot assign a role — the Add role assignment option is greyed out.
   Cause: You do not have Owner access on the subscription.
   Fix: Contact your Azure subscription owner to assign the required roles to the service principal.

5. Service principal validation passes but modules report an access error.
   Cause: The service principal credentials are valid but the principal lacks the required roles.
   Fix: Assign the roles listed in the configuration table above, then allow a few minutes for the changes to propagate.

FAQs

1. Can I assign roles at the resource group level instead of the subscription level?
   Yes, but this may limit module functionality. Turbo360 modules are designed to operate at the subscription scope. Assigning roles at the resource group level restricts visibility to only those resource groups and may cause incomplete data in the Turbo360 application.

2. Do I need to re-assign roles if I rotate the client secret?
   No. Azure RBAC roles are assigned to the service principal identity (the app registration), not to the client secret. Rotating the secret does not affect role assignments.

3. What is the minimum role required to use all Turbo360 modules?
   Assign both Reader and Billing Reader on the subscription. Reader covers resource access for all modules; Billing Reader adds cost and usage data access required by Cost Analyzer.

Related articles

• Service principal setup
• Connect Azure subscription
• Assign Azure roles using the Azure portal