Service principal setup

Overview

A service principal is an Azure identity that Turbo360 uses to authenticate with your Azure subscription. Setting up a service principal is a required step before you can connect any Azure subscription to Turbo360.

This article covers creating and registering a service principal for first-time Turbo360 setup. For ongoing management of service principals already added to Turbo360 — including editing credentials, rotating secrets, and managing multiple principals — see Service principal management.

Business value

Using a dedicated service principal for Turbo360 follows the principle of least privilege. Instead of granting broad personal account access, you create a scoped identity with only the permissions Turbo360 requires. This makes access auditable, revocable, and aligned with enterprise security policies.

Prerequisites

Before setting up a service principal for Turbo360, make sure you have:

• An active Microsoft Azure subscription
• Permission to register applications in Microsoft Entra ID (Azure Active Directory)
• Permission to assign roles on your Azure subscription
• A Turbo360 organization with Organization Administrator access

Required permissions

Dependencies

• Microsoft Azure subscription
• Microsoft Entra ID (Azure Active Directory) access
• Turbo360 organization active and accessible

How it works

Turbo360 connects to Azure using the OAuth 2.0 client credentials flow. You register an application in Microsoft Entra ID to create a service principal, generate a client secret, and assign the appropriate Azure RBAC roles to the principal. You then add the principal's credentials — friendly name, client ID, client secret, Microsoft Entra ID, and optionally a secret expiry date — to Turbo360 under Settings > Service principals.

Service principals are stored centrally in Turbo360 and are available for selection when connecting any Azure subscription. All Turbo360 modules — Cost Analyzer, Business Applications, Business Activity Monitoring, and Azure Documenter — share the same pool of service principals.

When you set a client secret expiry date, Turbo360 sends an alert notification 7 days before the secret expires, giving you time to rotate it without disrupting connected modules.

Steps

Step 1 — Register an application in Microsoft Entra ID

1. Sign in to the Azure portal.
2. Go to Microsoft Entra ID > App registrations.
3. Click New registration.
4. Enter a name for the application (for example, Turbo360).
5. Under Supported account types, select Accounts in this organizational directory only.
6. Click Register.
7. On the app overview page, copy the Application (client) ID and the Directory (tenant) ID. You will need these when adding the principal to Turbo360.

Step 2 — Create a client secret

1. In the registered app, go to Certificates & secrets.
2. Click New client secret.
3. Enter a description and select an expiry period.
4. Click Add.
5. Copy the secret Value immediately. It is only shown once.

Step 3 — Assign an Azure role to the service principal

1. In the Azure portal, go to Subscriptions and select your target subscription.
2. Click Access control (IAM) > Add role assignment.
3. Select the appropriate role for the modules you plan to use. See Permission requirements for Turbo360 for the full list of required roles per module.
4. Under Members, search for the application name you registered and select it.
5. Click Review + assign.

Step 4 — Add the service principal to Turbo360

1. In Turbo360, go to Settings > Service principals.
2. Click Add.
3. Enter the following values:

4. Click Validate, then click Add.

The service principal is now available for selection when connecting an Azure subscription.

Configuration

Permission behavior

With access (Account owner): You can add, validate, edit, and remove service principals under Settings > Service principals. You can associate principals with Azure subscriptions and receive expiry alerts.

Without access: The Settings > Service principals page is not available. Contact your Turbo360 organization administrator to manage service principals.

Example scenario

Your organization wants to connect a production Azure subscription to Turbo360. You register a new application called Turbo360-Prod in Microsoft Entra ID, generate a client secret with a 12-month expiry, and assign the Reader role on the subscription to the principal. In Turbo360, you go to Settings > Service principals, click Add, enter the friendly name, client ID, client secret, and tenant ID, set the expiry date to receive an advance alert, and click Validate, then Add. The principal now appears in the service principal list and can be selected when connecting the subscription.

Limitations

• A client secret is only visible once at creation. If you lose it, you must generate a new secret in Microsoft Entra ID and update it in Turbo360.
• Turbo360 does not support certificate-based authentication for service principals — only client secrets are supported.
• Deleting a service principal from Turbo360 does not remove the app registration from Microsoft Entra ID. You must delete the app registration separately in the Azure portal.

Troubleshooting

1. Validation fails after entering credentials.
   Cause: The client ID, client secret, or Microsoft Entra ID (tenant ID) may contain extra spaces, or the client secret has expired in Microsoft Entra ID.
   Fix: Verify all credentials are copied correctly with no extra spaces. Confirm the client secret has not expired.

2. Cannot find the application under Access control (IAM).
   Cause: The app registration may not be visible if searched by display name when there is a propagation delay.
   Fix: Try searching by the Application (client) ID directly in the role assignment member search.

3. Expiry alert not received.
   Cause: The client secret expiry date is not set on the service principal in Turbo360.
   Fix: Confirm the expiry date is set under Settings > Service principals. Alerts are sent 7 days before the expiry date to the notification channels configured in your organization.

4. Service principal added but not available in subscription dropdown.
   Cause: The page may not have refreshed after saving.
   Fix: Refresh the page. If the principal still does not appear, verify it was saved successfully by checking the list under Settings > Service principals.

5. Turbo360 shows an access error after connecting a subscription.
   Cause: The service principal may lack the required Azure RBAC role on the subscription.
   Fix: Verify role assignments in the Azure portal under Access control (IAM) on the target subscription.

FAQs

1. Can I use the same service principal for multiple Azure subscriptions?
   Yes. A single service principal can be selected when connecting multiple subscriptions, as long as it has the required RBAC roles on each subscription.

2. Can I use service principals from different Azure tenants?
   Yes. Turbo360 supports service principals with different Microsoft Entra IDs, allowing you to connect resources and subscriptions across tenant boundaries within the same Turbo360 organization.

3. What happens if my client secret expires?
   Turbo360 will lose access to the connected subscription and modules will stop receiving data. Rotate the secret in Microsoft Entra ID, update it in Turbo360 under Settings > Service principals, and re-validate the principal.

Related articles

• Connect Azure subscription
• Permission requirements for Turbo360
• Register an application in Microsoft Entra ID