add more details in the topics page about Service Principal

Author: nader-ziada

docs/topics/identity.md

@@ -8,7 +8,34 @@ This feature is used to create nodes which have an identity provisioned onto the
 All identities used in Azure are owned by Azure Active Directory (AAD). An identity, or principal, in AAD will provide the basis for each of the flavors of identities we will describe.
 
 ### Service Principal
-A service principal is an identity in AAD which is described by a TenantID, ClientID, and ClientSecret. The set of these three values will enable the holder to exchange the values for a JWT token to communicate with Azure. The values are normally stored in a file or environment variables. The user generally creates a service principal, saves the credentials, and then uses the credentials in applications. 
+A service principal is an identity in AAD which is described by a TenantID, ClientID, and ClientSecret. The set of these three values will enable the holder to exchange the values for a JWT token to communicate with Azure. The values are normally stored in a file or environment variables. The user generally creates a service principal, saves the credentials, and then uses the credentials in applications. You can read more about
+Service Principals and AD Applications: ["Application and service principal objects in Azure Active Directory"](https://azure.microsoft.com/en-us/documentation/articles/active-directory-application-objects/).
+
+#### Creating a Service Principal
+
+* **With the [Azure CLI](https://github.com/Azure/azure-cli)**
+
+  * Subscription level scope
+     ```shell
+     az login
+     az account set --subscription="${AZURE_SUBSCRIPTION_ID}"
+     az ad sp create-for-rbac --role="Owner" --scopes="/subscriptions/${AZURE_SUBSCRIPTION_ID}"
+     ```
+  * Resource group level scope
+     ```shell
+     az login
+     az account set --subscription="${AZURE_SUBSCRIPTION_ID}"
+     az ad sp create-for-rbac --role="Owner" --scopes="/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}"
+     ```
+
+   This will output your `appId`, `password`, `name`, and `tenant`.  The `name` or `appId` is used for the `AZURE_CLIENT_ID` and the `password` is used for `AZURE_CLIENT_SECRET`.
+
+   Confirm your service principal by opening a new shell and run the following commands substituting in `name`, `password`, and `tenant`:
+
+   ```shell
+   az login --service-principal -u NAME -p PASSWORD --tenant TENANT
+   az vm list-sizes --location eastus
+   ```
 
 
 ### System-assigned managed identity