There is a command group 'az_ad_sp'. This group of commands could 'manage microsoft entra service principals'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_ad_sp_create for rbac'.The syntax is: az ad sp create-for-rbac [--cert]
                         [--create-cert]
                         [--display-name]
                         [--json-auth {false, true}]
                         [--keyvault]
                         [--role]
                         [--scopes]
                         [--years]. The 1th example of the child command would be to use it to 'create without role assignment', the syntax is: az ad sp create-for-rbac. The 2th example of the child command would be to use it to 'create using a custom display name', the syntax is: az ad sp create-for-rbac -n MyApp. The 3th example of the child command would be to use it to 'create with a contributor role assignments on specified scopes  to retrieve current subscription id  run  az account show   query id   output tsv', the syntax is: az ad sp create-for-rbac -n MyApp --role Contributor --scopes /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourceGroup1 /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourceGroup2. The 4th example of the child command would be to use it to 'create using a self signed certificate', the syntax is: az ad sp create-for-rbac --create-cert. The 5th example of the child command would be to use it to 'create using a self signed certificate  and store it within keyvault', the syntax is: az ad sp create-for-rbac --keyvault MyVault --cert CertName --create-cert. The 6th example of the child command would be to use it to 'create using existing certificate in keyvault', the syntax is: az ad sp create-for-rbac --keyvault MyVault --cert CertName. The parameter '--cert' is optional. certificate to use for credentials. when used with `--keyvault,`, indicates the name of the cert to use or create. otherwise, supply a pem or der formatted public certificate string. use `@{path}` to load from a file. do not include private key info.. The parameter '--create-cert' is optional. create a self-signed certificate to use for the credential. only the current os user has read/write permission to this certificate. use with `--keyvault` to create the certificate in key vault. otherwise, a certificate will be created locally.. The parameter '--display-name --name -n' is optional. display name of the service principal. if not present, default to azure-cli-%y-%m-%d-%h-%m-%s where the suffix is the time of creation.. The parameter '--json-auth --sdk-auth' is optional. output service principal credential along with cloud endpoints in json format.. The parameter '--keyvault' is optional. name or id of a keyvault to use for creating or retrieving certificates.. The parameter '--role' is optional. role of the service principal.. The parameter '--scopes' is optional. space-separated list of scopes the service principal's role assignment applies to. e.g., subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourcegroups/mygroup, /subscriptions/0b1f6471-1bf0-4dda-aec3-111122223333/resourcegroups/mygroup/providers/microsoft.compute/virtualmachines/myvm.. The parameter '--years' is optional. number of years for which the credentials will be valid. default: 1 year.. 