Error handling request for AAD

[chasewilson]

Is your feature request related to a problem? Please describe.

As a user, permissions errors may be confusing when working with RBAC systems in az ad and could be improved to provide meaningful guidance to address permissions in the correct location. E.g. Azure vs AAD permissions and User account vs Service Principal account.

Describe the solution you'd like

• If the user signed in to the cli with a service principal, if the call to the Graph returns insufficient permissions the cli could say
  “you signed in with a service principal, either sign in as a user or add the service principal to a role in AAD that has permissions
  to create service principals (like Application Developer)”.
• If the user signed in to the cli with a user, the cli could say “add your user account to a role in AAD that has permissions to
  create service principals (like Application Developer)”.

Describe alternatives you've considered

NA

Additional context

Adding @skwan for tracking and conversation.

[yonzhan]

@jiasli for awareness