xxxxxxxxxx
spPassword="MyServicePrincipal1!"
subscriptionId=$(az account show --query id -o tsv)
resourceGroup="MyResourceGroup" # must exist
az ad sp create-for-rbac --name $appId --password $spPassword \
--role contributor \
--scopes /subscriptions/$subscriptionId/resourceGroups/$resourceGroup