Just getting started with this stuff: I'm using typescript. I've figured out how to authenticate to Azure using a ServicePrincipal that I created myself. Now I'd like to automate the creation of a ServicePrincipal and give it the built in "Contributor" role on a Subscription. I can create the Application, ServicePrincipal and set the password - but how do I assign it the Contributor role on a Subscription?

You need

azure.authorization.Assignment

https://github.com/pulumi/pulumi-azure/blob/master/sdk/nodejs/authorization/assignment.ts#L18

Fantastic, thanks.