adding sp instructions to README
@@ -52,8 +52,41 @@ Ready to quickly deploy the latest version of Azure Service Operator on your Kub
```sh
helm repo add azureserviceoperator https://raw.githubusercontent.com/Azure/azure-service-operator/master/charts
```
+3. Create an Azure Service Principal. You'll need this to grant Azure Service Operator permissions to create resources in your subscription.
-3. Install the Azure Service Operator on your cluster using the following helm install command.
+ First, set the following variables to your Azure Tenant ID and Subscription ID with your values:
+ ```yaml
+ AZURE_TENANT_ID=00000000-0000-0000-0000-000000000000
+ AZUR_SUBSCRIPTION_ID=00000000-0000-0000-0000-000000000000
+ ```
+
+ You can find these values by running the following:
+ ```sh
+ az account show
+ ```
+ Next, we'll create a service principal with Contributor permissions for your subscription, so ASO can create resources in your subscription on your behalf.
+
+ ```sh
+ az ad sp create-for-rbac -n "azure-service-operator" --role contributor \
+ --scopes /subscriptions/$AZURE_SUBSCRIPTION_ID
+ ```
+
+ This should give you an output like the following:
+ ```sh
+ "appId": "xxxxxxxxxx",
+ "displayName": "azure-service-operator",
+ "name": "http://azure-service-operator",
+ "password": "xxxxxxxxxxx",
+ "tenant": "xxxxxxxxxxxxx"
+ ```
+
+ Once you have created a service principal, set the following variables to your app ID and password values:
+ ```sh
+ AZURE_CLIENT_ID=00000000-0000-0000-0000-000000000000 # This is the appID from the service principal we created.
+ AZURE_CLIENT_SECRET=00000000-0000-0000-0000-000000000000 # This is the password from the service principal we created.
+ ```
+
+4. Install the Azure Service Operator on your cluster using the following helm install command.
Note that the [ServicePrincipal](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli) you pass to the command below needs to have access to create resources in your subscription. If you'd like to use Managed Identity for authorization instead, check out instructions [here](docs/howto/managedidentity.md)
