# Create a Service Principal

The following Azure CLI command creates a Service Principal with the `Reader` role on a subscription:

```bash
az ad sp create-for-rbac \
  --name pandora-azure-sql-discovery \
  --role Reader \
  --scopes /subscriptions/<SUBSCRIPTION_ID>
```

The command returns values similar to these:

```json
{
  "appId": "<CLIENT_ID>",
  "displayName": "pandora-azure-sql-discovery",
  "password": "<CLIENT_SECRET>",
  "tenant": "<TENANT_ID>"
}
```

Use them in the Discovery task as follows:

```text
tenant       -> Tenant ID
appId        -> Client ID
password     -> Client secret
subscription -> Subscription ID
```