<p>Update:<br />
A colleague who works for Microsoft said:</p>
<blockquote>
<p>Changelog entry for this behaviour change is here: <a href="https://github.com/MicrosoftDocs/azure-docs-cli/blob/master/docs-ref-conceptual/release-notes-azure-cli.md#aks-3" rel="nofollow noreferrer">https://github.com/MicrosoftDocs/azure-docs-cli/blob/master/docs-ref-conceptual/release-notes-azure-cli.md#aks-3</a></p>
</blockquote>
<hr>
<p>I'm following the proper instructions and the documentation must be out of date.</p>
<p><a href="https://learn.microsoft.com/en-us/azure/aks/kubernetes-service-principal" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/kubernetes-service-principal</a></p>
<blockquote>
<p><strong>Automatically create and use a service principal.</strong><br />
When you create an AKS cluster in the Azure portal or using the az aks create command, Azure can automatically generate a service principal.
In the following Azure CLI example, a service principal is not specified. In this scenario, the Azure CLI creates a service principal for the AKS cluster. To successfully complete the operation, your Azure account must have the proper rights to create a service principal.</p>
</blockquote>
<pre><code>az aks create --name myAKSCluster --resource-group myResourceGroup
</code></pre>
<p>This is what happened a few months ago - see <strong>Finished service principal creation</strong>:</p>
<p><a href="https://i.stack.imgur.com/0IF56.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0IF56.png" alt="enter image description here" /></a></p>
<p>Now when I try I get <strong>Add role propagation</strong>:</p>
<p><a href="https://i.stack.imgur.com/blJZd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/blJZd.png" alt="enter image description here" /></a></p>
<p>The problem is querying the servicePrincipalProfile.clientId results in <strong>msi</strong>, I need the guid of the service principal not the Managed Service Identity.</p>
<pre><code>$CLIENT_ID=$(az aks show --resource-group $AKS_RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query &quot;servicePrincipalProfile.clientId&quot; --output tsv)
echo $CLIENT_ID
</code></pre>
<p>Used to work:</p>
<p><a href="https://i.stack.imgur.com/tDZXj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tDZXj.png" alt="enter image description here" /></a></p>
<p>Now its changed:</p>
<p><a href="https://i.stack.imgur.com/GnNxh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GnNxh.png" alt="enter image description here" /></a></p>
<p>How do I create the Kubernetes Cluster with a Service Principal as the documentation states and how it used to work?</p>
<p>Repro steps:</p>
<p><a href="https://github.com/MeaningOfLights/AzureTraining/blob/master/Hands-On-Labs-That-Work/80-Kubernetes.md" rel="nofollow noreferrer">https://github.com/MeaningOfLights/AzureTraining/blob/master/Hands-On-Labs-That-Work/80-Kubernetes.md</a></p>
<p><a href="https://github.com/MeaningOfLights/AzureTraining/blob/master/Hands-On-Labs-That-Work/85-Kubernetes-Deployment.md" rel="nofollow noreferrer">https://github.com/MeaningOfLights/AzureTraining/blob/master/Hands-On-Labs-That-Work/85-Kubernetes-Deployment.md</a></p>

Jeremy Thompson
<p>For Reference: I got the same and following your <a href="https://github.com/MicrosoftDocs/azure-docs-cli/blob/master/docs-ref-conceptual/release-notes-azure-cli.md#aks-3" rel="nofollow noreferrer">link</a> I found that this worked.</p>
<pre><code>az aks show -g aks -n cluster --query identityProfile.kubeletidentity.clientId -o tsv
</code></pre>
<p><a href="https://i.stack.imgur.com/FaaOL.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FaaOL.png" alt="enter image description here" /></a></p>
<p>and this returned the appropriate guide, that I could use for my RBAC assignment</p>
<pre><code># get the clientId of the cluster
$clientId = (az aks show -g aks -n cluster --query identityProfile.kubeletidentity.clientId -o tsv)

# get the resourceId of the registry
$acrId=(az acr show -g acr -n myacr --query id -o tsv)


# give authority for cluster id to the acr pull
az role assignment create $clientId --role AcrPull --scope $acrId
</code></pre>
