Merge pull request #253000 from csmulligan/csmulligan-ciam-least-includes

[CIAM] Updated least privileged role for includes (ADO-164052)

Author: prmerger-automator[bot]

articles/active-directory/external-identities/customers/how-to-customize-branding-customers.md

@@ -57,7 +57,7 @@ The following image displays the neutral default branding of the customer tenant
 
 Before you customize any settings, the neutral default branding will appear in your sign-in and sign-up pages. You can customize this default experience with a custom background image or color, favicon, layout, header, and footer. You can also upload a [custom CSS](/azure/active-directory/fundamentals/reference-company-branding-css-template). 
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator).
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the customer tenant you created earlier.
 1. Browse to **Company Branding** > **Default sign-in** > **Edit**.
 
@@ -174,7 +174,7 @@ Your customer tenant name replaces the Microsoft banner logo in the neutral defa
 
 :::image type="content" source="media/how-to-customize-branding-customers/tenant-name.png" alt-text="Screenshot of the tenant name." lightbox="media/how-to-customize-branding-customers/tenant-name.png":::
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator).
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the customer tenant you created earlier.
 1. In the search bar, type and select **Properties**.
 1. Edit the **Name** field. 
@@ -187,7 +187,7 @@ Your customer tenant name replaces the Microsoft banner logo in the neutral defa
 
 When no longer needed, you can remove the sign-in customization from your customer tenant via the Azure portal.  
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator).
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the customer tenant you created earlier.
 1. Browse to **Company branding** > **Default sign-in experience** > **Edit**.
 1. Remove the elements you no longer need.

articles/active-directory/external-identities/customers/how-to-customize-languages-customers.md

@@ -27,7 +27,7 @@ You can create a personalized sign-in experience for users who sign in using a s
 
 ## Add browser language under Company branding
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator).
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the customer tenant you created earlier.
 1. Browse to **Company branding** > **Browser language customizations** > **Add browser language**. 
 
@@ -86,7 +86,7 @@ The following languages are supported in the customer tenant:
 
 Language customization in the customer tenant allows your user flow to accommodate different languages to suit your customer's needs.  You can use languages to modify the strings displayed to your customers as part of the attribute collection process during sign-up.
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Global Administrator](/azure/active-directory/roles/permissions-reference#global-administrator).  
 2. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to the customer tenant you created earlier.
 3. Browse to **Identity** > **External Identities** > **User flows**.
 5. Select the user flow that you want to enable for translations.

articles/active-directory/external-identities/customers/how-to-register-ciam-app.md

@@ -40,7 +40,7 @@ External ID for customers supports authentication for Single-page apps (SPAs).
 
 The following steps show you how to register your SPA in the Microsoft Entra admin center:
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](/azure/active-directory/roles/permissions-reference#application-developer).
 
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to your customer tenant. 
 
@@ -82,7 +82,7 @@ External ID for customers supports authentication for web apps.
 
 The following steps show you how to register your web app in the Microsoft Entra admin center:
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](/azure/active-directory/roles/permissions-reference#application-developer). 
 
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to your customer tenant. 
 
@@ -137,7 +137,7 @@ If your web app needs to call an API, you must grant your web app API permission
 
 The following steps show you how to register your app in the Microsoft Entra admin center:
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](/azure/active-directory/roles/permissions-reference#application-developer). 
 
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to your customer tenant. 
 

articles/active-directory/external-identities/customers/includes/configure-user-flow/create-sign-in-sign-out-user-flow.md

@@ -8,7 +8,7 @@ ms.author: kengaderdus
 ---
 Follow these steps to create a user flow a customer can use to sign in or sign up for an application.
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [External ID User Flow Administrator](/azure/active-directory/roles/permissions-reference#external-id-user-flow-administrator).  
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to your customer tenant. 
 1. Browse to **Identity** > **External Identities** > **User flows**.
 1. Select **+ New user flow**.

articles/active-directory/external-identities/customers/includes/register-app/add-client-app-certificate.md

@@ -9,7 +9,7 @@ ms.author: kengaderdus
 
 To use your client app certificate, you need to associate the app you registered in the Microsoft Entra admin center with the certificate:
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Administrator](/azure/active-directory/roles/permissions-reference#application-administrator). 
 
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to your customer tenant. 
 

articles/active-directory/external-identities/customers/includes/register-app/register-api-app.md

@@ -7,7 +7,7 @@ ms.date: 03/30/2023
 ms.author: kengaderdus
 ---
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](/azure/active-directory/roles/permissions-reference#application-developer).
 
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to your customer tenant. 
 

articles/active-directory/external-identities/customers/includes/register-app/register-client-app-common.md

@@ -12,7 +12,7 @@ To enable your application to sign in users with Microsoft Entra, Microsoft Entr
 
 The following steps show you how to register your app in the Microsoft Entra admin center:
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least an [Application Developer](/azure/active-directory/roles/permissions-reference#application-developer).
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to your customer tenant. 
 1. Browse to **Identity** >**Applications** > **App registrations**.
 1. Select **+ New registration**.

articles/active-directory/external-identities/customers/includes/register-app/register-daemon-app.md

@@ -9,7 +9,7 @@ ms.author: kengaderdus
 
 The following steps show you how to register your daemon app in the Microsoft Entra admin center:
 
-1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com)  as at least an [Application Developer](/azure/active-directory/roles/permissions-reference#application-developer).
 
 1. If you have access to multiple tenants, use the **Directories + subscriptions** filter :::image type="icon" source="../../media/common/portal-directory-subscription-filter.png" border="false"::: in the top menu to switch to your customer tenant. 
 

articles/active-directory/external-identities/user-properties.md

@@ -6,7 +6,7 @@ services: active-directory
 ms.service: active-directory
 ms.subservice: B2B
 ms.topic: how-to
-ms.date: 05/18/2023
+ms.date: 09/27/2023
 ms.author: cmulligan
 author: csmulligan
 manager: celestedg