Add failed authorization container registry tsg

Author: vs-li

articles/machine-learning/how-to-troubleshoot-online-endpoints.md

@@ -276,9 +276,28 @@ To run the `score.py` provided as part of the deployment, Azure creates a contai
 
 ### ERROR: ResourceNotFound
 
-This error occurs when Azure Resource Manager can't find a required resource. For example, you will receive this error if a storage account was referred to but cannot be found at the path on which it was specified. Be sure to double check resources that might have been supplied by exact path or the spelling of their names.
+Below is a list of reasons you might run into this error:
+
+* [Azure Resource Manager cannot find a required resource](#resource-manager-cannot-find-a-resource)
+* [Azure Container Registry is private or otherwise inaccessible](#container-registry-authorization-error)
+
+#### Resource Manager cannot find a resource
+
+This error occurs when Azure Resource Manager can't find a required resource. For example, you will receive this error if a storage account was referred to but is not able to be found at the specified path. Be sure to double-check the spelling of exact paths or resource names.
+
+For more information, see [Resolve Resource Not Found Errors](../azure-resource-manager/troubleshooting/error-not-found.md).
+
+#### Container registry authorization error
+
+This error occurs when an image belonging to a private or otherwise inaccessible container registry was supplied for deployment. 
+At this time, our APIs cannot accept private registry credentials. 
+
+To mitigate this error, either ensure that the container registry is **not private** or follow the following steps:
+1. Grant your private registry's `acrPull` role to the system identity of your online enpdoint.
+1. In your environment definition, specify the address of your private image as well as the additional instruction to not modify (build) the image.
 
-For more information, see [Resolve resource not found errors](../azure-resource-manager/troubleshooting/error-not-found.md). 
+If the mitigation is successful, the image will not require any building and the final image address will simply be the given image address.
+At deployment time, your online endpoint's system identity will pull the image from the private registry.
 
 ### ERROR: OperationCancelled