Merge pull request #120591 from aalewismsft/patch-4

Update quickstart-create-application-gateway-for-containers-byo-deplo…

Author: Jak-MS

articles/application-gateway/for-containers/quickstart-create-application-gateway-for-containers-byo-deployment.md

@@ -87,6 +87,9 @@ ALB_SUBNET_ID=$(az network vnet subnet list --resource-group $VNET_RESOURCE_GROU
 echo $ALB_SUBNET_ID
 ```
 
+> [!NOTE]
+> The NSG for the delegated subnet can only use the default rules for incoming traffic. For example: AllowVNetInBound, AllowAzureLoadBalancerInBound, and DenyAllInbound. No other incoming NSG rule is supported.
+   
 ### Delegate permissions to managed identity
 
 ALB Controller needs the ability to provision new Application Gateway for Containers resources and join the subnet intended for the Application Gateway for Containers association resource.