diff --git a/doc/030_preparing_a_new_repo.rst b/doc/030_preparing_a_new_repo.rst
index 04fa45468..8661f5904 100644
--- a/doc/030_preparing_a_new_repo.rst
+++ b/doc/030_preparing_a_new_repo.rst
@@ -549,6 +549,14 @@ For authentication export one of the following variables:
     # For SAS
     $ export AZURE_ACCOUNT_SAS=<SAS_TOKEN>
 
+For authentication using ``az login`` set the resource group name and ensure the user has
+the minimum permissions of the role assignment ``Storage Blob Data Contributor`` on Azure RBAC.
+
+.. code-block:: console
+
+    $ export AZURE_RESOURCE_GROUP=<RESOURCE_GROUP_NAME>
+    $ az login
+
 Alternatively, if run on Azure, restic will automatically uses service accounts configured
 via the standard environment variables or Workload / Managed Identities.