Merge pull request #15756 from leslielin-5/patch-14

Update aks-edge-howto-connect-to-arc.md

Author: prmerger-automator[bot]

AKS-Hybrid/aks-edge-howto-connect-to-arc.md

@@ -14,11 +14,11 @@ This article describes how to connect your AKS Edge Essentials cluster to [Azure
 
 ## Prerequisites
 
-In addition to these prerequisites, be sure to meet all [network requirements for Azure Arc-enabled Kubernetes](/azure/azure-arc/kubernetes/network-requirements).
-
-- You need an Azure subscription with either the **Owner** role or a combination of **Contributor** and **User Access Administrator** roles. You can check your access level by navigating to your subscription on the Azure portal, selecting **Access control (IAM)** on the left-hand side of the Azure portal, and then selecting **View my access**. See [the Azure documentation](/azure/azure-resource-manager/management/manage-resource-groups-portal) for more information about managing resource groups.
-- Enable all required resource providers in the Azure subscription, such as **Microsoft.HybridCompute**, **Microsoft.GuestConfiguration**, **Microsoft.HybridConnectivity**, **Microsoft.Kubernetes**, **Microsoft.ExtendedLocation**, and **Microsoft.KubernetesConfiguration**.
-- Create and verify a resource group for AKS Edge Essentials Azure resources.
+- Before connecting to Arc, infrastructure administrators who are the owner or contributor role of the subscription will have to:
+  1. Enable all required resource providers in the Azure subscription, such as **Microsoft.HybridCompute**, **Microsoft.GuestConfiguration**, **Microsoft.HybridConnectivity**, **Microsoft.Kubernetes**, **Microsoft.ExtendedLocation**, and **Microsoft.KubernetesConfiguration**.
+  2. Create and verify a resource group for AKS Edge Essentials Azure resources
+- To connect to Arc, Kubernetes operator will need a [**Kubernetes Cluster - Azure Arc Onboarding**](/azure/role-based-access-control/built-in-roles/containers#kubernetes-cluster---azure-arc-onboarding) role for the identity at the resource group level. To disconnect from Arc, operator will need an [**Azure Kubernetes Service Arc Contributor Role**](/azure/role-based-access-control/built-in-roles/containers#azure-kubernetes-service-arc-contributor-role) role for the identity at the resource group level.  You can check your access level by navigating to your subscription on the Azure portal, selecting **Access control (IAM)** on the left-hand side, and then selecting **View my access**. See [the Azure documentation](/azure/azure-resource-manager/management/manage-resource-groups-portal) for more information about managing resource groups. Infrastructure Administrators with owner or contributor roles can also perform the actions to connect or disconnect from Arc.
+- In addition to these prerequisites, be sure to meet all [network requirements for Azure Arc-enabled Kubernetes](/azure/azure-arc/kubernetes/network-requirements).
 
 > [!NOTE]
 > You need the **Contributor** role to be able to delete the resources within the resource group. Commands to disconnect from Arc will fail without this role assignment.