Expand note

Author: anthonychu

articles/container-apps/manage-secrets.md

@@ -194,7 +194,7 @@ az containerapp create \
 Here, a connection string to a queue storage account is declared in the `--secrets` parameter. Replace `<KEY_VAULT_SECRET_URI>` with the URI of your secret in Key Vault. Replace `<USER_ASSIGNED_IDENTITY_ID>` with the resource ID of the user assigned identity. For system assigned identity, use `System` instead of the resource ID.
 
 > [!NOTE]
-> The user assigned identity must have access to read the secret in Key Vault.
+> The user assigned identity must have access to read the secret in Key Vault. System assigned identity can't be used with the create command because it's not available until after the container app is created.
 
 # [PowerShell](#tab/powershell)