Merge pull request #106952 from davidmu1/openshift1

Graph scrub for openshift

Author: PRMerger7

articles/openshift/howto-aad-app-configuration.md

@@ -88,15 +88,12 @@ For details on creating a new Azure AD application, see [Register an app with th
 
 ## Add API permissions
 
-1. In the **Manage** section click **API permissions**.
-2. Click **Add permission** and select **Azure Active Directory Graph** then **Delegated permissions**. 
-3. Expand **User** on the list below and enable the **User.Read** permission. If **User.Read** is enabled by default, ensure that it is the **Azure Active Directory Graph** permission **User.Read**, *not* the **Microsoft Graph** permission **User.Read**.
-4. Scroll up and select **Application permissions**.
-5. Expand **Directory** on the list below and enable **Directory.ReadAll**
-6. Click **Add permissions** to accept the changes.
-7. The API permissions panel should now show both *User.Read* and *Directory.ReadAll*. Please note the warning in **Admin consent required** column next to *Directory.ReadAll*.
-8. If you are the *Azure Subscription Administrator*, click **Grant admin consent for *Subscription Name*** below. If you are not the *Azure Subscription Administrator*, request the consent from your administrator.
-![Screenshot of the API permissions panel. User.Read and Directory.ReadAll permissions added, admin consent required for Directory.ReadAll](./media/howto-aad-app-configuration/permissions-required.png)
+1. In the **Manage** section click **API permissions**, and then click **+Add a permission**. 
+3. In the **Request API Permissions** pane, select the **Microsoft APIs** tab, and then select the **Microsoft Graph** tile. Select **Application permissions**.
+4. Search for **User** and enable the **User.Read** permission. Search for **Directory** and enable **Directory.Read.All**.
+5. Click **Add permissions** to accept the changes.
+6. The API permissions panel should now show both *User.Read* and *Directory.Read.All*. Please note the warning in **Admin consent required** column next to *Directory.Read.All*.
+7. If you are the *Azure Subscription Administrator*, click **Grant admin consent for *Subscription Name***. If you are not the *Azure Subscription Administrator*, request the consent from your administrator.
 
 > [!IMPORTANT]
 > Synchronization of the cluster administrators group will work only after consent has been granted. You will see a green circle with a checkmark and a message "Granted for *Subscription Name*" in the *Admin consent required* column.