Merge pull request #194269 from dksimpson/1912257-RBAC-fix-16

Update RBAC role assignment steps - batch 16

Author: PRMerger7

articles/healthcare-apis/fhir/configure-export-data.md

@@ -5,7 +5,7 @@ author: ranvijaykumar
 ms.service: healthcare-apis
 ms.subservice: fhir
 ms.topic: reference
-ms.custom: references_regions
+ms.custom: references_regions, subject-rbac-steps
 ms.date: 03/01/2022
 ms.author: cavoeg
 ---
@@ -26,17 +26,27 @@ The first step in configuring the FHIR service for export is to enable system wi
 
 In this step, browse to your FHIR service in the Azure portal, and select the **Identity** blade. Select the **Status** option to **On** , and then select **Save**. **Yes** and **No** buttons will display. Select **Yes** to enable the managed identity for FHIR service. Once the system identity has been enabled, you'll see a system assigned GUID value. 
 
-[ ![Enable Managed Identity](media/export-data/fhir-mi-enabled.png) ](media/export-data/fhir-mi-enabled.png#lightbox)
+[![Enable Managed Identity](media/export-data/fhir-mi-enabled.png)](media/export-data/fhir-mi-enabled.png#lightbox)
 
 ## Assign permissions to the FHIR service to access the storage account
 
-Browse to the **Access Control (IAM)** in the storage account, and then select **Add role assignment**. If the add role assignment option is grayed out, you'll need to ask your Azure Administrator to assign you permission to perform this task.
+1. Select **Access Control (IAM)**.
 
-For more information about assigning roles in the Azure portal, see [Azure built-in roles](../../role-based-access-control/role-assignments-portal.md).
+1. Select **Add > Add role assignment**. If the **Add role assignment** option is grayed out, ask your Azure administrator to assign you permission to perform this task.
+
+   :::image type="content" source="../../../includes/role-based-access-control/media/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::
+
+1. On the **Roles** tab, select the [Storage Blob Data Contributor](../../role-based-access-control/built-in-roles.md#storage-blob-data-contributor) role.
+
+   [![Screen shot showing user interface of Add role assignment page.](../../../includes/role-based-access-control/media/add-role-assignment-page.png)](../../../includes/role-based-access-control/media/add-role-assignment-page.png#lightbox)
 
-Add the role [Storage Blob Data Contributor](../../role-based-access-control/built-in-roles.md#storage-blob-data-contributor) to the FHIR service, and then select **Save**.
+1. On the **Members** tab, select **Managed identity**, and then select **Select members**.
 
-[![Screen shot showing user interface of Add role assignment page.](../../../includes/role-based-access-control/media/add-role-assignment-page.png) ](../../../includes/role-based-access-control/media/add-role-assignment-page.png#lightbox)
+1. Select **System-assigned managed identity**, and then select the FHIR service.
+
+1. On the **Review + assign** tab, select **Review + assign** to assign the role.
+
+For more information about assigning roles in the Azure portal, see [Azure built-in roles](../../role-based-access-control/role-assignments-portal.md).
 
 Now you're ready to select the storage account in the FHIR service as a default storage account for export.
 
@@ -49,7 +59,7 @@ The final step is to assign the Azure storage account that the FHIR service will
 
 To do this, select the  **Export** blade in FHIR service and select the storage account. To search for the storage account, enter its name in the text field. You can also search for your storage account by using the available filters **Name**, **Resource group**, or **Region**. 
 
-[![Screen shot showing user interface of FHIR Export Storage.](media/export-data/fhir-export-storage.png) ](media/export-data/fhir-export-storage.png#lightbox)
+[![Screen shot showing user interface of FHIR Export Storage.](media/export-data/fhir-export-storage.png)](media/export-data/fhir-export-storage.png#lightbox)
 
 After you've completed this final step, you're ready to export the data using $export command.
 

articles/healthcare-apis/fhir/convert-data.md

@@ -8,6 +8,7 @@ ms.subservice: fhir
 ms.topic: overview
 ms.date: 03/21/2022
 ms.author: ranku
+ms.custom: subject-rbac-steps
 ---
 
 
@@ -119,15 +120,23 @@ Change the status to **On** to enable managed identity in FHIR service.
 
 ### Provide access of the ACR to FHIR service
 
-1. Browse to the **Access control (IAM)** blade.
+1. Select **Access Control (IAM)**.
 
-1. Select **Add**, and then select **Add role assignment** to open the Add role assignment page.
+1. Select **Add > Add role assignment**. If the **Add role assignment** option is grayed out, ask your Azure administrator to assign you permission to perform this task.
 
-1. Assign the [AcrPull](../../role-based-access-control/built-in-roles.md#acrpull) role. 
+   :::image type="content" source="../../../includes/role-based-access-control/media/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::
 
-   [ ![Add role assignment page](../../../includes/role-based-access-control/media/add-role-assignment-page.png) ](../../../includes/role-based-access-control/media/add-role-assignment-page.png#lightbox) 
+1. On the **Roles** tab, select the [AcrPull](../../role-based-access-control/built-in-roles.md#acrpull) role.
 
-For more information about assigning roles in the Azure portal, see [Screen image of Azure built-in roles.](../../role-based-access-control/role-assignments-portal.md).
+   [![Screen shot showing user interface of Add role assignment page.](../../../includes/role-based-access-control/media/add-role-assignment-page.png)](../../../includes/role-based-access-control/media/add-role-assignment-page.png#lightbox)
+
+1. On the **Members** tab, select **Managed identity**, and then select **Select members**.
+
+1. Select **System-assigned managed identity**, and then select the FHIR service.
+
+1. On the **Review + assign** tab, select **Review + assign** to assign the role.
+
+For more information about assigning roles in the Azure portal, see [Azure built-in roles](../../role-based-access-control/role-assignments-portal.md).
 
 ### Register the ACR servers in FHIR service