add updates

Author: laujan

articles/ai-services/document-intelligence/faq.yml

@@ -207,9 +207,7 @@ sections:
 
             - **Storage Account Contributor**: You need this role for the storage account to set up cross-origin resource sharing (CORS) settings. It's a one-time effort if you reuse the same storage account.
 
-            - **Contributor**: You need this role to create a resource group and resources.
-
-          Having Contributor or Storage Account Contributor role doesn't give you access to use your Document Intelligence resource or storage account if local (key-based) authentication is disabled. You still need the basic roles (Cognitive Services User and Storage Data Blob Contributor) to use the functions on Document Intelligence Studio.
+            - **Contributor**: You need this role to create a resource group and resources. **Contributor** or **Storage Account Contributor** role doesn't give you access to use your Document Intelligence resource or storage account if local (key-based) authentication is disabled. You still need the basic roles (**Cognitive Services User** and **Storage Data Blob Contributor**) to use the functions on Document Intelligence Studio.
 
           For more information, see [Microsoft Entra built-in roles](../../role-based-access-control/built-in-roles.md) and the sections about Azure role assignments in the [Document Intelligence Studio quickstart](quickstarts/try-document-intelligence-studio.md).
 
@@ -256,6 +254,44 @@ sections:
 
           - Re-create a custom project with the migrated Document Intelligence resource and specify the same storage account.
 
+      - question: |
+          Why an I receiving the error "PermissionDenied" when using prebuilt apps or opening my custom project?
+        answer: |
+          If you received error "PermissionDenied: Principal does not have access to API/Operation" when analyzing against prebuilt models or opening a custom project, it is likely the local (key-based) authentication is disabled for your Document Intelligence resource and your do not have enough permission to access the resource.  Please reference [Azure role assignments](quickstarts/try-document-intelligence-studio.md#azure-role-assignments) to configure your access roles.
+
+      - question: |
+          Why an I receiving the error "AuthorizationPermissionMismatch" when opening my custom project?
+        answer: |
+          If you received error "AuthorizationPermissionMismatch: This request is not authorized to perform this operation using this permission" when opening a custom project, it is likely the local (key-based) authentication is disabled for your storage account and your do not have enough permission to access the blob data.  Please reference [Azure role assignments](quickstarts/try-document-intelligence-studio.md#azure-role-assignments-1) to configure your access roles.
+
+      - question: |
+          Why am I not able to sign in to Document Intelligence Studio and keeps seeing InteractionRequiredAuthError error (AADSTS50058)?
+        answer: |
+          If you received error "InteractionRequiredAuthError: login_required: AADSTS50058: A silent sign-request was sent but no user is signed in.", this is due to 3rd-party cookies are blocked by your browser so we cannot successfully sign in your account.
+        
+          For **Edge** users, please:
+          - Go to **Settings** for Edge
+          - Search for "**third-party**"
+          - Go to **Manage and delete cookies and site data**
+          - Turn off the setting of **Block third-party cookies**
+
+          For **Chrome** users, please:
+          - Go to **Settings** for Chrome
+          - Search for "**Third-party**"
+          - Under **Default behavior**, select **Allow third-party cookies**
+
+          For **Firefox** users, please:
+          - Go to **Settings** for Firefox
+          - Search for "**cookies**"
+          - Under **Enhanced Tracking Protection**, select **Manage Exceptions**
+          - Add exception for **https://documentintelligence.ai.azure.com** or the Document Intelligence Studio URL of your environment
+
+          For **Safari** users, please:
+          - Choose **Safari** > **Preferences**
+          - Click **Privacy**
+          - Deselect **Block all cookies**
+
+
       - question: |
          Are there separate URL endpoints for Document Intelligence sovereign cloud regions?
         answer: |

articles/ai-services/document-intelligence/managed-identities-secured-access.md

@@ -285,7 +285,7 @@ That's it! You can now configure secure access for your Document Intelligence re
 
   :::image type="content" source="media/managed-identities/access-denied.png" alt-text="Screenshot of an access denied error.":::
 
-  **Resolution**: Check to make sure there's connectivity between the computer accessing the Document Intelligence Studio and the Document Intelligence service. For example, you might need to allow the client IP address in **Networking > Firewalls and virtual networks** setting page of both Document Intelligence resource and storage account.
+  **Resolution**: Make sure the client computer can access Document Intelligence resource and storage account, either they are in the same `VNET`, or client IP address is allowed in **Networking > Firewalls and virtual networks** setting page of both Document Intelligence resource and storage account.
 
 ## Next steps
 

articles/ai-services/document-intelligence/quickstarts/try-document-intelligence-studio.md

@@ -104,6 +104,9 @@ For custom projects, the following role assignments are required for different s
   * **Storage Account Contributor**: You need this role for the Storage Account to set up CORS settings (this action is a one-time effort if the same storage account is reused).
   * **Contributor**: You need this role to create a resource group and resources.
 
+  > [!NOTE]
+  > If local (key-based) authentication is disabled for your Document Intelligence service resource and storage account, be sure to obtain **Cognitive Services User** and **Storage Blob Data Contributor** roles respectively, so you have enough permissions to use Document Intelligence Studio.  The **Storage Account Contributor** and **Contributor** roles only allow you to list keys but does not give you permission to use the resources when key-access is disabled.
+
 ### Configure CORS
 
 [CORS (Cross Origin Resource Sharing)](/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services) needs to be configured on your Azure storage account for it to be accessible from the Document Intelligence Studio. To configure CORS in the Azure portal, you need access to the CORS tab of your storage account.