Update internal-lb.md

Added a note in the Specify a different subnet section to bring the attention on a possible permission issue.

Author: ripom

articles/aks/internal-lb.md

@@ -223,6 +223,9 @@ spec:
   selector:
     app: internal-app
 ```
+> [!NOTE]
+> 
+> You may need to assign the *Microsoft.Network/virtualNetworks/subnets/read* permission to the AKS cluster MSI on the VNet.
 
 ## Delete the load balancer