fix the typo

Author: genlin

support/entra/entra-id/app-integration/error-code-aadsts50000-issuing-token-sign-in-service.md

@@ -35,11 +35,11 @@ Make sure the client ID is valid and other required parameters are configured co
 
 ## Cause 3: Consent-related issues
 
-The error you're referring to occurs during the OAuth2 device authorization grant flow when making a request to the token endpoint. After the user signs in to a browser window and accepts the consent dialog, this error occurs.
+This issue can occur in an OAuth2 Device code grant flow to the token endpoint. After the user signs in to a browser window and accepts the consent dialog, this error occurs.
 
 ### Solution 3 for cause 3: verify application consent settings
 
-1. Go to the [Azure portal](https//portal.azure.com), make sure that the client application (Service Principal) exists in the tenant's **Enterprise Applications** page. You can search for the application by App ID.
+1. Go to the [Azure portal](https://portal.azure.com), make sure that the client application (Service Principal) exists in the tenant's **Enterprise Applications** page. You can search for the application by App ID.
 2. Verify that the user has the ability to consent to the application. Check user settings in the **Enterprise Applications** page or review relevant policies affecting user consent.
 
 ## Cause 4: Symmetric signing key is used in the application or service principal object
@@ -56,30 +56,30 @@ Microsoft Identity Platform (v2 endpoint) tokens must be signed by a certificate
 
     :::image type="content" source="./media/error-code-aadsts50000-issuing-token-sign-in-service/manifest-sample.png" alt-text="Application Manifest Key Credentials" lightbox="/media/error-code-aadsts50000-issuing-token-sign-in-service/manifest-sample.png":::
 
-Alternatively, use the AzureAD PowerShell cmdlet [Get-AzureADApplicationKeyCredential](https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureadapplicationkeycredential?view=azureadps-2.0) to retrieve key credentials.
+Alternatively, use the AzureAD PowerShell cmdlet [Get-AzureADApplicationKeyCredential](/powershell/module/azuread/get-azureadapplicationkeycredential) to retrieve key credentials.
 
 #### Step 2: Check if symmetric key is used in service principal object
 
 1. If the application is not found in the **App Registrations** page in the Azure portal, browse to the **Enterprise Applications** page.
 2. Locate the application, and then get the **Object ID** of the Service Principal.
-3. Use the AzureAD PowerShell cmdlet [Get-AzureADServicePrincipalKeyCredential](https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureadserviceprincipalkeycredential?view=azureadps-2.0) to retrieve key credentials.
+3. Use the AzureAD PowerShell cmdlet [Get-AzureADServicePrincipalKeyCredential](/powershell/module/azuread/get-azureadserviceprincipalkeycredential) to retrieve key credentials.
 
 #### Step 3: Remove symmetric signing key
 
 If the symmetric key exits, use:
 
-- [Remove-AzureADApplicationKeyCredential](/powershell/module/azuread/remove-azureadapplicationkeycredential?view=azureadps-2.0) to remove the symmetric key for the app registration.
-- [Remove-AzureADServicePrincipalKeyCredential](/powershell/module/azuread/remove-azureadserviceprincipalkeycredential?view=azureadps-2.0) to remove the symmetric key for the service principal object.
+- [Remove-AzureADApplicationKeyCredential](/powershell/module/azuread/remove-azureadapplicationkeycredential) to remove the symmetric key for the app registration.
+- [Remove-AzureADServicePrincipalKeyCredential](/powershell/module/azuread/remove-azureadserviceprincipalkeycredential) to remove the symmetric key for the service principal object.
 
-If a signing key is required, use a signing certificate instead. For more information, see [SAML-based single sign-on: Configure a signing certificate](/graph/application-saml-sso-configure-api?tabs=http%2Cpowershell-script#step-6-configure-a-signing-certificate)
+If a signing key is required, use a signing certificate instead. For more information, see [SAML-based single sign-on: Configure a signing certificate](/graph/application-saml-sso-configure-api?tabs=http%2Cpowershell-script#step-6-configure-a-signing-certificate).
 
 ## Cause 5: No delegated permission exposed in the resource application (web API)
 
 This error can occur in the following scenario:
 
 - You have a multitenant resource application registered in tenant A. This application exposes only **Application Permission** type.
 - In a different tenant B, you have a client application registered. In the **API permission** page for this application, you configure the permission for the resource application registered in the other tenant.
-- Then, you use an OAuth 2 delegated grant flow (for instance auth code grant flow) to request an access token for the resource app using the `/.default` for the web API scope.
+- Then, you use an OAuth2.0 On-Behalf-Of (delegation) flow to request an access token for the resource app with the `/.default` for the web API scope.
 
 ### Solution for cause 5