clarify that system will add acrpull role to system-assigned managed identity

Author: cebundy

articles/container-apps/managed-identity-image-pull.md

@@ -93,7 +93,7 @@ Create a container app revision with a private image and the system-assigned man
 1. Select **Save**.
 1. Select **Create** from the **Create and deploy new revision** page.
 
-A new revision will be created and deployed.  The portal will automatically attempt to add the `acrpull` role to the user-assigned managed identity.  If the role isn't added, you can add it manually.
+A new revision will be created and deployed.  The portal will automatically attempt to add the `acrpull` role to the user-assigned managed identity.  If the role isn't added, you can add it manually.  You can verify that the role was added by checking the identity in the **Identity** pane of the container app page.
 
 ### Clean up resources
 
@@ -172,6 +172,8 @@ Edit the container to use the image from your private Azure Container Registry,
 1. Select **Create** at the bottom of the **Create and deploy new revision** page
 1. After a few minutes, select **Refresh**  on the **Revision management** page to see the new revision.
 
+A new revision will be created and deployed.  The portal will automatically attempt to add the `acrpull` role to the system-assigned managed identity.  If the role isn't added, you can add it manually.  You can verify that the role was added by checking the identity in the **Identity** pane of the container app page.
+
 ### Clean up resources
 
 If you're not going to continue to use this application, you can delete the Azure Container Apps instance and all the associated services by removing the resource group.
@@ -435,7 +437,7 @@ Create your container app with your image from the private registry authenticate
 
 # [Azure CLI](#tab/azure-cli)
 
-Copy the identity's resource ID to paste into the *\<IDENTITY_ID\>* placeholders in the command below.
+Copy the identity's resource ID to paste into the *\<IDENTITY_ID\>* placeholders in the command below. If your image tag isn't `latest`, replace 'latest' with it.
 
 ```azurecli
 echo $IDENTITY_ID
@@ -557,7 +559,7 @@ New-AzContainerApp @AppArgs
 
 Update the container app with the image from your private container registry and add a system-assigned identity to authenticate the Azure Container Registry pull.  You can also include other settings necessary for your container app, such as ingress, scale and Dapr settings.  
 
-If you are using an image tag other than `latest`, replace the `latest` value with your value.
+If your image tag isn't `latest`, replace 'latest' with it.
 
 
 # [Azure CLI](#tab/azure-cli)
@@ -569,7 +571,7 @@ az containerapp registry set \
   --name $CONTAINERAPP_NAME \
   --resource-group $RESOURCE_GROUP \
   --identity system \
-  --server "$REGISTRY_NAME.azurecr.io"
+  --server "$REGISTRY_NAME.azurecr.io:latest"
 ```