AZURE_CREDENTIALS
az ad sp create-for-rbac --name "MyApp" --role contributor --scopes /subscriptions/{SubID}/resourceGroups/{ResourceGroup1} /subscriptions/{SubID}/resourceGroups/{ResourceGroup2}
ARM_CLIENT_ID
ARM_CLIENT_SECRET_ID
ARM_SUBSCRIPTION_ID
ARM_TENANT_ID