Merge pull request #239305 from JackStromberg/patch-120

Permissions call-out

Author: prmerger-automator[bot]

articles/application-gateway/ingress-controller-install-existing.md

@@ -6,7 +6,7 @@ author: greg-lindsay
 ms.service: application-gateway
 ms.custom: devx-track-arm-template
 ms.topic: how-to
-ms.date: 04/27/2023
+ms.date: 05/25/2023
 ms.author: greglin
 ---
 
@@ -119,6 +119,9 @@ looks something like this: `/subscriptions/A/resourceGroups/B/providers/Microsof
         --scope <App-Gateway-Resource-Group-ID>
     ```
 
+>[!Note]
+>If the virtual network Application Gateway is deployed into doesn't reside in the same resource group as the AKS nodes, please ensure the identity used by AGIC has _Network Contributor_ role assigned to the subnet the Application Gateway is deployed into.
+
 ## Using a Service Principal
 It's also possible to provide AGIC access to ARM via a Kubernetes secret.