The first thing we need to do is create a service principal by way of a new app registration. We do that through Azure Active Directory. First, I need to save the tenant id as we'll need that later. You can copy that from either the overview or property pages. Next, go into App Registrations and create a new registration. For the record, there is no app. The app registration can be thought of as a scaffold or home for the service principal. Give the app a name and select "Accounts in this organizational directory only" as the supported account type. The redirect URI  type is web, and the URI is any valid URI. Remember, this isn't a real app, and the URI won't be accessed – it just has to be in the correct format. Click the register button. Next, we need to create the means of authentication for our service principal, and we do that through certificates and secrets by creating a client secret. Click new client secret, select an expiry date and give the secret a name. Previously you had the option of never expires, but now 24 months is the longest time – even if you try to use a custom range. Copy the secret value, as this will be the service principal's password. The application id will be the service principal's name. 

The next step is to create a role with permissions that will enable the service principal to read, stop and start virtual machines, and assign the role to the service principal. To carry out this next step, you will need to be a subscription owner or user access administrator and have Azure AD Premium P1 or P2. Use the New-AzRoleDefintion PowerShell command with a JSON definition template to create the custom role. The tenant id goes after subscriptions under assignable scopes. Actions under permissions define the role's abilities. The role can monitor virtual machines with read permissions on all aspects of Microsoft compute, and it can power off and start VMs. Once created, assign the role to the service principal through your subscription's access control with add role assignment.  Alternatively, you can create the custom role through the portal by going into your subscription and selecting Access Control. On the bottom right, click add under create a custom role. I'm going to use start from JSON and use the template file I already have. The custom role will take a few minutes to register and become available. Assign the role to the service principal by going into add role assignment, selecting the new role, and clicking next. Click select members to find the Fence Agent Principal and select to add to the role. Then click next and review and assign. If, at any stage, your service principal has become assigned the owner role, remove it.

You use the resource group, tenant id, application id, and value password from the application registration to register each node running the Azure Fence Agent. The pcmk_host_map option is required when the virtual machine's name isn't the same as its hostname.