Update azure-stack-edge-gateway-add-storage-account.md

Add description of role requirement for creating edge storage account with new MSI feature introduced

Author: GeorgeH-MS

includes/azure-stack-edge-gateway-add-storage-account.md

@@ -19,6 +19,14 @@ ms.author: alkohli
     2. Provide an optional description for the information on the data the storage account is holding.  
 
     3. By default, the Edge storage account is mapped to an Azure Storage account in the cloud, and the data from the storage account is automatically pushed to the cloud. Specify the Azure storage account that your Edge storage account is mapped to.
+   > [!IMPORTANT]
+   > Tiering data from an Azure Stack Edge Pro or Data Box Gateway device to the mapped Azure Storage account uses Managed Service Identity to authorize the data access. Make sure that the Azure Storage account that you use has the following roles being assigned to the Managed identities for Azure Stack Edge resource:
+   >
+   > * Storage Blob Data Contributor
+   > * Storage File Data Privileged Contributor
+   > * Contributor
+   > 
+   > For more information, see [Assign an Azure role for access to blob data](../storage/blobs/assign-azure-role-data-access.md?tabs=portal#assign-an-azure-role).
 
     4. Create a new container, or select from an existing container in the Azure storage account. Any data from the device that is written to the Edge storage account is automatically uploaded to the selected storage container in the mapped Azure Storage account.
 
@@ -30,4 +38,4 @@ ms.author: alkohli
 
     ![Add a storage account 2](media/azure-stack-edge-gateway-add-storage-account/add-storage-account-4.png)
 
-    You get the access keys by [Connecting to the device local APIs using Azure Resource Manager](../articles/databox-online/azure-stack-edge-gpu-connect-resource-manager.md).
+    You get the access keys by [Connecting to the device local APIs using Azure Resource Manager](../articles/databox-online/azure-stack-edge-gpu-connect-resource-manager.md).