Update ACR role assignment instructions

Added note about ABAC role assignments for ACR.

Author: MaxHorstmann

articles/deployment-environments/how-to-configure-extensibility-model-custom-image.md

@@ -504,6 +504,10 @@ In this configuration, ADE uses the Managed Identity for the PET, whether system
 > [!Tip]
 > This role assignment has to be made for every project environment type. It can be automated through the Azure CLI.
 
+> [!Tip]
+> If your ACR uses [Microsoft Entra attribute-based access control (ABAC) for repository permissions](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-rbac-abac-repository-permissions), you might need to make additional role assignments such as `Container Registry Repository Reader` to the PET identity.
+
+
 When you're ready to push your image to your registry, run the following command:
 
 ```docker
@@ -545,4 +549,4 @@ To learn more about how to create environment definitions that use the ADE conta
 - [ADE CLI variables reference](reference-deployment-environment-variables.md)
 ::: zone pivot="pulumi"
 - [Pulumi's azure-deployment-environments repository](https://github.com/pulumi/azure-deployment-environments)
-::: zone-end
+::: zone-end