your tenant ID should be this one: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-to-find-tenant

Some progress, I had to grant the Enterprise Application role=owner within the pre existing ResourceGroup that should host the resources accessed during stack.UpAsync() in my automation code. This Microsoft doc describes how to assign roles within the Azure Dashboard https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal After successfully creating a SQL Database my automation function is now failing at a later stage because for some reason an additional resource group is being created then being removed on the next UpAsync() test run. I need to tame these spurious resource group creations and persuade Pulumi to work within a single existing resource group.