title: Adding write permission for creating Resource Groups to an Azure Active Directory Application
body: <p>I have a C# application that will create Resource Groups. I'm using the ResourceManagementClient to create the resource group (which I assume is just a wrapper for their REST API). I'm using an Azure AD application's Client ID and Client Secret to authenticate.</p>
  
  <p>I'm getting this error:</p>
  
  <blockquote>
    <p>{"The client 'xxxx' with object id 'xxxx' does not have authorization
    to perform action
    'Microsoft.Resources/subscriptions/resourcegroups/write' over scope
    '/subscriptions/xxxx/resourcegroups/test-resource-group'."}</p>
  </blockquote>
  
  <p>Is there a way I can give this permission at the subscription level to an Azure AD application?</p>