fix: message

Author: santiagxf

articles/ai-foundry/model-inference/includes/configure-entra-id/portal.md

@@ -22,9 +22,9 @@ Follow these steps to configure Microsoft Entra ID for inference:
 
    3. Go to the section **Connected resources** and select the connection to the Azure AI Services resource that you want to configure. If it isn't listed, select **View all** to see the full list.
 
-   4. On the **Connection details** section, under **Resource**, select the name of the Azure resource. A new page opens.
+      :::image type="content" source="../../media/configure-entra-id/resource-behind-select.png" alt-text="Screenshot showing how to navigate to the details of the connection in Azure AI Foundry in the management center." lightbox="../../media/configure-entra-id/resource-behind-select.png":::
 
-      :::image type="content" source="../../media/configure-entra-id/resource-behind-open.png" alt-text="Screenshot showing how to navigate to the details of the connection in Azure AI Foundry in the management center." lightbox="../../media/configure-entra-id/resource-behind-open.png":::
+   4. On the **Connection details** section, under **Resource**, select the name of the Azure resource. A new page opens.
 
    5. You're now in [Azure portal](https://portal.azure.com) where you can manage all the aspects of the resource itself.
 
@@ -92,6 +92,4 @@ To change this behavior, you have to update the connections from your projects t
 
 ## Disable key-based authentication in the resource
 
-Disabling key-based authentication is advisable when you implemented Microsoft Entra ID and fully addressed compatibility or fallback concerns in all the applications that consume the service.
-
-
+Disabling key-based authentication is advisable when you implemented Microsoft Entra ID and fully addressed compatibility or fallback concerns in all the applications that consume the service. [Disabling key-based authentication is only available when deploying using Bicep/ARM](../../how-to/configure-entra-id.md?dpivots=programming-language-bicep#disable-key-based-authentication-in-the-resource).

articles/ai-foundry/model-inference/includes/configure-entra-id/troubleshooting.md

@@ -7,6 +7,21 @@ ms.date: 01/23/2025
 ms.topic: include
 ---
 
+Before troubleshooting, verify that you have the right permissions assigned:
+
+1. Go to the [Azure portal](https://portal.azure.com) and locate the **Azure AI Services** resource you're using.
+
+2. On the left navigation bar, select **Access control (IAM)** and then select **Check access**.
+
+3. Type the name of the user or identity you are using to connect to the service.
+
+4. Verify that the role **Cognitive Services User** is listed (or a role that contains the required permissions as explained in [Prerequisites](#prerequisites)).
+
+    > [!IMPORTANT]
+    > Roles like **Owner** or **Contributor** don't provide access via Microsoft Entra ID.
+
+5. If not listed, follow the steps in this guide before continuing.
+
 The following table contains multiple scenarios that can help troubleshooting Microsoft Entra ID:
 
 | Error / Scenario     | Root cause    | Solution |