Update quickstart-create-application-gateway-for-containers-byo-deployment.md

Added a note regarding NSG configuration for delegated subnets.

Author: aalewismsft

articles/application-gateway/for-containers/quickstart-create-application-gateway-for-containers-byo-deployment.md

@@ -87,6 +87,9 @@ ALB_SUBNET_ID=$(az network vnet subnet list --resource-group $VNET_RESOURCE_GROU
 echo $ALB_SUBNET_ID
 ```
 
+> [!NOTE]
+> The NSG for the delegated subnet can only use the default rules for incoming traffic i.e. AllowVNetInBound, AllowAzureLoadBalancerInBound and DenyAllInbound. No other incoming NSG rule is supported.
+   
 ### Delegate permissions to managed identity
 
 ALB Controller needs the ability to provision new Application Gateway for Containers resources and join the subnet intended for the Application Gateway for Containers association resource.