update docs for managed hsm (#15817)

Author: BethanyZhou

src/KeyVault/KeyVault/help/New-AzKeyVaultManagedHsm.md

@@ -21,8 +21,10 @@ New-AzKeyVaultManagedHsm [-Name] <String> [-ResourceGroupName] <String> [-Locati
 
 ## DESCRIPTION
 The **New-AzKeyVaultManagedHsm** cmdlet creates a managed HSM in the specified resource group. To add, 
-remove, or list keys in the managed HSM, user should grant permissions by adding user ID to 
-Administrator.
+remove, or list keys in the managed HSM, user should: 
+1. grant permissions by adding user ID to Administrator;
+2. add role assignment for user like "Managed HSM Crypto User" and so on;
+3. back up security domain data of a managed HSM using `Export-AzKeyVaultSecurityDomain`.
 
 ## EXAMPLES
 

src/KeyVault/KeyVault/help/New-AzKeyVaultRoleAssignment.md

@@ -58,9 +58,15 @@ And to specify an Azure AD application, use ApplicationId or ObjectId parameters
 The role that is being assigned must be specified using the RoleDefinitionName pr RoleDefinitionId parameter. The scope at which access is being granted may be specified. It defaults to the selected subscription.
 
 ## EXAMPLES
-
 ### Example 1
 ```powershell
+PS C:\> New-AzKeyVaultRoleAssignment -HsmName bez-hsm -RoleDefinitionName "Managed Hsm Crypto User" -ObjectId xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+```
+
+This example assigns role "Managed Hsm Crypto User" to user "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" at top scope. If user wants to perform operations on keys. "Managed Hsm Crypto *" role is required for that user.
+
+### Example 2
+```powershell
 PS C:\> New-AzKeyVaultRoleAssignment -HsmName myHsm -RoleDefinitionName "Managed HSM Policy Administrator" -SignInName [email protected]
 
 RoleDefinitionName               DisplayName                    ObjectType Scope