To scale up Web Portal nodes on the Azure Marketplace with an existing Virtual Network, you must perform the following post-deployment steps.
Create a custom role with:
"Microsoft.Network/virtualNetworks/subnets/join/action"
"Microsoft.Network/networkSecurityGroups/join/action"
You can create a custom role. For further instructions for creating a role, see the Creating a Custom Role at the Subscription Level section.
Go to IAM tab under Existing VNet and assign this custom role to managed Identity.
Click Add > Add role assignment. For further steps, see the Adding Managed Application Contributor Role section.
...