Add AcrPull role assignment instructions

articles/container-apps/tutorial-ci-cd-runners-jobs.md

@@ -418,7 +418,7 @@ To avoid using administrative credentials, pull images from private repositories
     # [PowerShell](#tab/powershell)
 
     ```powershell
-    IDENTITY_ID=$(az identity show `
+    $IDENTITY_ID=$(az identity show `
         --name $IDENTITY `
         --resource-group $RESOURCE_GROUP `
         --query id `
@@ -427,6 +427,30 @@ To avoid using administrative credentials, pull images from private repositories
 
     ---
 
+1. Assign the AcrPull role to the managed identity.
+
+    # [Bash](#tab/bash)
+
+    ```azurecli
+    az role assignment create \
+        --assignee-object-id "$(az identity show --ids "$IDENTITY_ID" --query principalId -o tsv)" \
+        --assignee-principal-type ServicePrincipal \
+        --role "AcrPull" \
+        --scope "$(az acr show --name "$CONTAINER_REGISTRY_NAME" --query id -o tsv)"
+    ```
+
+    # [PowerShell](#tab/powershell)
+
+    ```powershell
+    az role assignment create `
+    --assignee-object-id $(az identity show --ids $IDENTITY_ID --query principalId -o tsv) `
+    --assignee-principal-type ServicePrincipal `
+    --role "AcrPull" `
+    --scope $(az acr show --name $CONTAINER_REGISTRY_NAME --query id -o tsv)
+    ```
+
+    ---
+
 ## Deploy a self-hosted runner as a job
 
 You can now create a job that uses the container image. In this section, you create a job that runs the self-hosted runner and authenticates with GitHub by using the PAT you generated earlier. The job uses the [`github-runner` scale rule](https://keda.sh/docs/latest/scalers/github-runner/) to create job executions based on the number of pending workflow runs.