"az ad sp create-for-rbac" does not set sensible defaults and the resulting principal is not very usable. It would be great if it would setup defaults as the following "az ad sp create-for-rbac --role contributor --scopes /subscriptions/SUBSCRIPTIONID".