Update assign-role.md

Author: Smritib17

memdocs/intune/fundamentals/assign-role.md

@@ -40,17 +40,20 @@ To create, edit, or assign roles, your account must have one of the following pe
 
 2. On the **Endpoint Manager roles - All roles** blade, choose the built-in role you want to assign > **Assignments** > **+ Assign**.
 
-5. On the **Basics** page, enter an **Assignment name** and optional **Assignment description**, and then choose **Next**.
-For step #5 in this doc, we need to call out the following with a note:
-The All users and All devices are Intune virtual groups and not AAD security groups. As a result, for Scope group assignment purposes you cannot use them as parents of AAD security groups. If you need both All users/All devices and specific AAD security groups for scope group assignments, you must add them separately with separate assignments. Otherwise, even if you have All users for the role's scope group assignment the admin in this role won't have access to specific AAD user groups. For AAD security groups, nesting is supported.
+3. On the **Basics** page, enter an **Assignment name** and optional **Assignment description**, and then choose **Next**.
 
-6. On the **Admin Groups** page, select the group that contains the user you want to give the permissions to. Choose **Next**
+4. On the **Admin Groups** page, select the group that contains the user you want to give the permissions to. Choose **Next**
 
-7. On the **Scope (Groups)** page, choose a group containing the users/devices that the member above will be allowed to manage. You also have the option to choose all users and/or all devices. Choose **Next**.
+5. On the **Scope (Groups)** page, choose a group containing the users/devices that the member above will be allowed to manage. You also have the option to choose all users and/or all devices. Choose **Next**.
+  
+      > [!NOTE] 
+      > The **All users** and **All devices** are [Intune virtual groups](groups-add.md) and not Azure Active Directory (Azure AD) security groups. As a result, for **Scope (Groups)** assignment purposes you cannot use them as parents of Azure AD security groups. If you need both **All users** and **All devices** and specific Azure AD security groups for **Scope (Groups)** assignments, you must add them separately with separate assignments. Otherwise, even if the **Scope (Groups)** assignment for a role is set to **All Users** the admin in this role won't have access to specific Azure AD user groups.
+      >  
+      > For Azure AD security groups, nesting is supported.
 
-8. On the **Scope (Tags)** page, choose tags where this role assignment will be applied. Choose **Next**.
+7. On the **Scope (Tags)** page, choose tags where this role assignment will be applied. Choose **Next**.
 
-9. On the **Review + Create** page, when you're done, choose **Create**. The new assignment is displayed in the list of assignments.
+8. On the **Review + Create** page, when you're done, choose **Create**. The new assignment is displayed in the list of assignments.
 
 ## Next steps
 - [Learn more about role-based access control in Intune](role-based-access-control.md)