Updated parameter order and parameter table order for SAS token example

Author: DENKEN02MSFT

articles/iot-hub/authenticate-authorize-sas.md

@@ -222,16 +222,16 @@ This section provides examples of generating SAS tokens in different code langua
 
 A SAS token has the following format:
 
-`SharedAccessSignature sig={signature-string}&se={expiry}&skn={policyName}&sr={URL-encoded-resourceURI}`
+`SharedAccessSignature sr={URL-encoded-resourceURI}&sig={signature-string}&se={expiry}&skn={policyName}`
 
 Here are the expected values:
 
 | Value | Description |
 | --- | --- |
-| {signature-string} |An HMAC-SHA256 signature string of the form: `{URL-encoded-resourceURI} + "\n" + expiry`. **Important**: The key is decoded from base64 and used as key to perform the HMAC-SHA256 computation. |
+| {URL-encoded-resourceURI} |Lower case URL-encoding of the lower case resource URI |
 | {resourceURI} |URI prefix (by segment) of the endpoints that can be accessed with this token, starting with host name of the IoT hub (no protocol). SAS tokens granted to backend services are scoped to the IoT hub level; for example, `myHub.azure-devices.net`. SAS tokens granted to devices must be scoped to an individual device; for example, `myHub.azure-devices.net/devices/device1`. |
+| {signature-string} |An HMAC-SHA256 signature string of the form: `{URL-encoded-resourceURI} + "\n" + {expiry}`. **Important**: The key is decoded from base64 and used as key to perform the HMAC-SHA256 computation. |
 | {expiry} |UTF8 strings for number of seconds since the epoch 00:00:00 UTC on 1 January 1970. |
-| {URL-encoded-resourceURI} |Lower case URL-encoding of the lower case resource URI |
 | {policyName} |The name of the shared access policy to which this token refers. Absent if the token refers to device-registry credentials. |
 
 The URI prefix is computed by segment and not by character. For example, `/a/b` is a prefix for `/a/b/c` but not for `/a/bc`.