Update role-based-access-control.md

Author: eric-urban

articles/ai-services/speech-service/role-based-access-control.md

@@ -6,7 +6,7 @@ author: eric-urban
 manager: nitinme
 ms.service: azure-ai-speech
 ms.topic: conceptual
-ms.date: 9/23/2024
+ms.date: 11/19/2024
 ms.author: eur
 # Customer intent: As a developer, I want to learn how to assign access roles for a Speech resource.
 ---
@@ -46,23 +46,23 @@ For finer-grained resource access control, you can [add or remove roles](/azure/
 
 The [roles](#roles-for-speech-resources) define what permissions you have. Authentication is required to use the Speech resource. 
 
-To authenticate with Speech resource keys, all you need is the key and region. To authenticate with a Microsoft Entra token, the Speech resource must have a [custom subdomain](speech-services-private-link.md#create-a-custom-domain-name) and use a [private endpoint](speech-services-private-link.md#turn-on-private-endpoints). The Speech service uses custom subdomains with private endpoints only.
+o authenticate with Speech resource keys, all you need is the key and region. To authenticate with a Microsoft Entra token, the Speech resource must have a [custom subdomain](speech-services-private-link.md#create-a-custom-domain-name).
 
 ### Speech SDK authentication
 
 For the SDK, you configure whether to authenticate with a Speech resource key or Microsoft Entra token. For details, see [Microsoft Entra authentication with the Speech SDK](how-to-configure-azure-ad-auth.md).
 
 ### Speech Studio authentication
 
-Once you're signed into [Speech Studio](speech-studio-overview.md), you select a subscription and Speech resource. You don't choose whether to authenticate with a Speech resource key or Microsoft Entra token. Speech Studio gets the key or token automatically from the Speech resource. If one of the assigned [roles](#roles-for-speech-resources) has permission to list resource keys, Speech Studio authenticates with the key. Otherwise, Speech Studio authenticates with the Microsoft Entra token. 
+Once you're signed into [Speech Studio](speech-studio-overview.md), you select a subscription and Speech resource. You don't choose whether to authenticate with a Speech resource key or Microsoft Entra token. Speech Studio gets the key or token automatically from the Speech resource. If one of the assigned [roles](#roles-for-speech-resources) has permission to list resource keys and the key authentication is not disabled, Speech Studio authenticates with the key. Otherwise, Speech Studio authenticates with the Microsoft Entra token.
 
-If Speech Studio uses your Microsoft Entra token, but the Speech resource doesn't have a custom subdomain and private endpoint, then you can't use some features in Speech Studio. In this case, for example, the Speech resource can be used to train a custom speech model, but you can't use a custom speech model to transcribe audio files.
+If Speech Studio uses your Microsoft Entra token, but the Speech resource doesn't have a custom subdomain, then you can't use any features in Speech Studio. If you don't have necessary role permissions for a feature in Speech Studio, you can't use it, and you will see a permission warning banner on the page.
 
-| Authentication credential | Feature availability | 
-| ---| ---|  
-|Speech resource key|Full access. Role configuration is ignored if resource key is used.|
-|Microsoft Entra token with custom subdomain and private endpoint|Full access limited only by the assigned role permissions.|
-|Microsoft Entra token without custom subdomain and private endpoint (not recommended)|Features are limited. For example, the Speech resource can be used to train a custom speech model or custom neural voice. But you can't use a custom speech model or custom neural voice.|
+| Authentication credential                      | Feature availability                                                |
+| ---------------------------------------------- | ------------------------------------------------------------------- |
+| Speech resource key                            | Full access. Role configuration is ignored if resource key is used. |
+| Microsoft Entra token with custom subdomain    | Full access limited only by the assigned role permissions.          |
+| Microsoft Entra token without custom subdomain | No access.                       |
 
 ## Next steps