SP with resource group level scope example (#3077)

Azure · May 24, 2018 · d65c809 · d65c809
1 parent 6a02217
commit d65c809
Showing 1 changed file with 12 additions and 5 deletions.
diff --git a/docs/serviceprincipal.md b/docs/serviceprincipal.md
@@ -19,11 +19,18 @@ There are several ways to create a Service Principal in Azure Active Directory:
 
 * **With the [Azure CLI](https://github.com/Azure/azure-cli)**
 
-   ```shell
-   az login
-   az account set --subscription="${SUBSCRIPTION_ID}"
-   az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/${SUBSCRIPTION_ID}"
-   ```
+  * Subscription level scope
+     ```shell
+     az login
+     az account set --subscription="${SUBSCRIPTION_ID}"
+     az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/${SUBSCRIPTION_ID}"
+     ```
+  * Resource group level scope
+     ```shell
+     az login
+     az account set --subscription="${SUBSCRIPTION_ID}"
+     az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_NAME}"
+     ```
 
    This will output your `appId`, `password`, `name`, and `tenant`.  The `name` or `appId` may be used for the `servicePrincipalProfile.clientId` and the `password` is used for `servicePrincipalProfile.secret`.