Merge pull request #187185 from billmath/fixes1

Fixes1

Author: PRMerger6

includes/active-directory-app-provisioning-sql.md

@@ -27,7 +27,7 @@ Note: The generic SQL connector requires that column names are case-insensitive.
  - An Azure AD tenant with Azure AD Premium P1 or Premium P2 (or EMS E3 or E5). 
 
     [!INCLUDE [active-directory-p1-license.md](active-directory-p1-license.md)]
- - The Hybrid Administrator role for configuring the provisioning agent and the Application Administrator or Cloud Administrator roles for configuring provisioning in the Azure portal.
+ - The Hybrid identity administrator role for configuring the provisioning agent and the Application Administrator or Cloud Administrator roles for configuring provisioning in the Azure portal.
 
 ## Prepare the sample database
 On a server running SQL Server, run the SQL script found in [Appendix A](#appendix-a). This script creates a sample database with the name CONTOSO. This is the database that you'll be provisioning users into.
@@ -36,7 +36,7 @@ On a server running SQL Server, run the SQL script found in [Appendix A](#append
 ## Create the DSN connection file
 The generic SQL connector is a DSN file to connect to the SQL server. First, you need to create a file with the ODBC connection information.
 
- 1. Start the ODBC management utility on your server.
+ 1. Start the ODBC management utility on your server.  Use the 64-bit version.
      ![Screenshot that shows ODBC management.](./media/active-directory-app-provisioning-sql/odbc.png)</br>
  2. Select the **File DSN** tab, and select **Add**. 
      ![Screenshot that shows the File DSN tab.](./media/active-directory-app-provisioning-sql/dsn-2.png)</br>
@@ -69,7 +69,7 @@ The generic SQL connector is a DSN file to connect to the SQL server. First, you
      >Please use different provisioning agents for on-premises application provisioning and Azure AD Connect Cloud Sync / HR-driven provisioning. All three scenarios should not be managed on the same agent. 
  1. Open the provisioning agent installer, agree to the terms of service, and select **next**.
  1. Open the provisioning agent wizard, and select **On-premises provisioning** when prompted for the extension you want to enable.
- 1. Provide credentials for an Azure AD administrator when you're prompted to authorize. Hybrid administrator or global administrator is required.
+ 1. Provide credentials for an Azure AD administrator when you're prompted to authorize. Hybrid identity administrator or global administrator is required.
  1. Select **Confirm** to confirm the installation was successful.
  1. Sign in to the Azure portal.
  1. Go to **Enterprise applications** > **Add a new application**.
@@ -82,7 +82,7 @@ The generic SQL connector is a DSN file to connect to the SQL server. First, you
 
 
  ## Configure the Azure AD ECMA Connector Host certificate
- 1. On the desktop, select the ECMA shortcut.
+ 1. Launch the Microsoft ECMA2Host Configuration Wizard from the start menu.
  2. After the ECMA Connector Host Configuration starts, leave the default port **8585** and select **Generate** to generate a certificate. The autogenerated certificate will be self-signed as part of the trusted root. The SAN matches the host name.
      ![Screenshot that shows configuring your settings.](.\media\active-directory-app-provisioning-sql\configure-1.png)
  3. Select **Save**.
@@ -211,6 +211,9 @@ The generic SQL connector is a DSN file to connect to the SQL server. First, you
 ## Assign users to an application
 Now that you have the Azure AD ECMA Connector Host talking with Azure AD, you can move on to configuring who's in scope for provisioning. 
 
+>[!IMPORTANT]
+>If you were signed in using a Hybrid identity administrator role, you need to sign-out and sign-in with an account that has the app administrator or global admininistrator role, for this section.  The Hybrid identity administrator role does not have permissions to assign users to applications.
+
  1. In the Azure portal, select **Enterprise applications**.
  2. Select the **On-premises provisioning** application.
  3. On the left, under **Manage**, select **Users and groups**.