Error handling request for AAD

[chasewilson]

Is your feature request related to a problem? Please describe.

As a user, permissions errors may be confusing when working with RBAC systems in az ad and could be improved to provide meaningful guidance to address permissions in the correct location. E.g. Azure vs AAD permissions and User account vs Service Principal account.

Describe the solution you'd like

• If the user signed in to the cli with a service principal, if the call to the Graph returns insufficient permissions the cli could say
  “you signed in with a service principal, either sign in as a user or add the service principal to a role in AAD that has permissions
  to create service principals (like Application Developer)”.
• If the user signed in to the cli with a user, the cli could say “add your user account to a role in AAD that has permissions to
  create service principals (like Application Developer)”.

Describe alternatives you've considered

NA

Additional context

Adding Stuart Kwan (@skwan) for tracking and conversation.

[yonzhan]

Jiashuo Li (@jiasli) for awareness

[MaddyMicrosoft]

This was a request to make az ad permission errors provide more role-specific guidance. Since then, the az ad surface has moved from Azure AD Graph to Microsoft Graph, and the error paths have changed substantially.

Given the age of the request and the limited demand signal, closing this out. If there is a specific current az ad permission error that needs clearer guidance, please open a fresh issue with the exact command, error text, and the guidance you expected.