Update batch-sig-images.md

Adding additional information on mimimum actions required for using compute gallery images on pool creation just like what we saw in https://portal.microsofticm.com/imp/v3/incidents/details/452464103/home

Author: clmendes-MSFT

articles/batch/batch-sig-images.md

@@ -45,7 +45,7 @@ Using a Shared Image configured for your scenario can provide several advantages
 >
 > The image can be in a different region as long as it has replicas in the same region as your Batch account.
 
-If you use a Microsoft Entra application to create a custom image pool with an Azure Compute Gallery image, that application must have been granted an [Azure built-in role](../role-based-access-control/rbac-and-directory-admin-roles.md#azure-roles) that gives it access to the Shared Image. You can grant this access in the Azure portal by navigating to the Shared Image, selecting **Access control (IAM)** and adding a role assignment for the application.
+If you use a Microsoft Entra application to create a custom image pool with an Azure Compute Gallery image, that application must have been granted an [Azure built-in role](../role-based-access-control/rbac-and-directory-admin-roles.md#azure-roles) that gives it access to the Shared Image. You can grant this access in the Azure portal by navigating to the Shared Image, selecting **Access control (IAM)** and adding a role assignment for the application. Please note that Reader permissions on the Azure Compute Gallery image is not enough as it is required minimum the following action 'Microsoft.Compute/disks/beginGetAccess/action'.
 
 ## Prepare a Shared Image