Merge pull request #292866 from wtnlee/sneakypawfinalvwan

fixed all issues

Author: prmerger-automator[bot]

articles/virtual-wan/roles-permissions.md

@@ -92,9 +92,22 @@ The Virtual WAN reader role has the ability to view and monitor all Virtual WAN-
 
 Creating or updating Virtual WAN resources requires you to have the proper permission(s) to create that Virtual WAN resource type. In some scenarios, having permissions to create or update that resource type is sufficient. However, in many scenarios, updating a Virtual WAN resource that has a **reference** to another Azure resource requires you to have permissions over both the created resource **and** any referenced resources.
 
+### Error Message
+
+A user or service principal must have sufficient permissions to execute an operation on a Virtual WAN resource. If the user does not have sufficient permissions to perform the operation, the operation will fail with an error message similar to the one below.
+
+|Error Code| Message|
+|--|--|
+|LinkedAccessCheckFailed| The client with object id 'xxx' does not have authorization to perform action 'xxx' over scope 'zzz resource' or the scope is invalid. If access was recently granted, please refresh your credentials.|
+
+> [!NOTE]
+> A user or service principal may be missing multiple permissions needed to manage a Virtual WAN resource. The returned error message only references one missing permission. As a result, you may see a different  missing permission after you update the permissions assigned to your service principal or user.  
+
+To fix this error, grant the user or service principal that is managing your Virtual WAN resource(s) the additional permission described in the error message and retry.
+
 ### Example 1
 
-When a connection is created between a Virtual WAN hub and a spoke Virtual Network, Virtual WAN's control plane creates a Virtual Network peering between the Virtual WAN hub and your spoke Virtual Network. You can also specify the Virtual WAN route tables to which the Virtual Network connection is associating to or propagating to.
+When a connection is created between a Virtual WAN hub and a spoke Virtual Network, Virtual WAN's control plane creates a Virutal Network peering between the Virtual WAN hub and your spoke Virtual Network. You can also specify the Virtual WAN route tables to which the Virtual Network connection is associating to or propagating to.
 
 Therefore, to create a Virtual Network connection to the Virtual WAN hub, you must have the following permissions:
 
@@ -110,7 +123,7 @@ If you want to associate an inbound or out-bound route map is associated with th
 
 To create or modify routing intent, a routing intent resource is created with a reference to the next hop resources specified in the routing intent's routing policy. This means that to create or modify routing intent, you need permissions over any referenced Azure Firewall or Network Virtual Appliance resource(s).
 
-If the next hop for a hub's private routing intent policy is a Network Virtual Appliance and the next hop for a hub's internet policy is an Azure Firewall, creating or updating a routing intent resource requires the following permissions.
+If the next hop for a hub's private routing intent policy is a Network Virtual Appliance  and the next hop for a hub's internet policy is an Azure Firewall, creating or updating a routing intent resource requires the following permisisons.
 
 * Create routing intent resource. (Microsoft.Network/virtualhubs/routingIntents/write)
 * Reference (read) the Network Virtual Appliance resource (Microsoft.Network/networkVirtualAppliances/read)
@@ -120,9 +133,9 @@ In this example, you do **not** need permissions to read Microsoft.Network/secur
 
 ## Additional permissions required due to referenced resources
 
-The following section describes the set of possible permissions that are needed to create or modify Virtual WAN resources.
+The following section describes the set of possible permisisons that are needed to create or modify Virtual WAN resources.
 
-Depending on your Virtual WAN configuration, the user or service principal that is managing your Virtual WAN deployments may need all, a subset or none of the below permissions. 
+Depending on your Virtual WAN configuration, the user or service principal that is managing your Virtual WAN deployments may need all, a subset or none of the below permissions over referenced resources.
 
 ### Virtual hub resources
 
@@ -176,11 +189,6 @@ For more information, see [Scope levels](../role-based-access-control/scope-over
 > [!NOTE]
 > Allow sufficient time for [Azure Resource Manager cache](../role-based-access-control/troubleshooting.md) to refresh after role assignment changes.
 
-## Permissions Error 
-
-If you see an error in the following format, then please make sure you have the above permissions properly configured. 
-
-Error message format: "The client with object id {} does not have authorization to perform action {} over scope {} or the scope is invalid. If access was recently granted, please refresh your credentials."
 
 ## Additional services