Add SharePoint Online API permissions and cert propagation warning

docs/accessanalyzer/2601/gettingstarted/sharepoint-online/set-up-source-group.md

@@ -19,26 +19,45 @@ sidebar_position: 3
 6. Under **Certificate**, click **Generate and Download Certificate** to generate a certificate and download it to your machine. Upload this certificate to your registered Entra ID application before proceeding. See [Certificate Configuration](../../connectors/sharepoint-online/tenant-certificate-config.md) for upload steps.
 
    :::note
-   If you click **Regenerate Certificate** in the future, the new certificate must be uploaded to your Entra ID App Registration to replace the old one. Removing the old certificate from the App Registration is a manual step in the Azure portal — Access Analyzer cannot remove it on your behalf.
+   If you click **Regenerate Certificate**, upload the new certificate to your Entra ID App Registration to replace the old one. Removing the old certificate from the App Registration is a manual step in the Azure portal — Access Analyzer can't remove it on your behalf.
+   :::
+
+   :::note
+   Grant the following API permissions, with admin consent, to the Entra ID application for the **Client ID** and certificate:
+
+   | API | Permission | Type | Description |
+   |---|---|---|---|
+   | Microsoft Graph | `Directory.Read.All` | Application | Read directory data |
+   | Microsoft Graph | `Files.Read.All` | Application | Read files in all site collections |
+   | Microsoft Graph | `Group.Read.All` | Application | Read all groups |
+   | Microsoft Graph | `Sites.FullControl.All` | Application | Have full control of all site collections |
+   | Microsoft Graph | `Sites.Read.All` | Application | Read items in all site collections |
+   | Microsoft Graph | `User.Read` | Delegated | Sign in and read user profile |
+   | Microsoft Graph | `User.Read.All` | Application | Read all users' full profiles |
+   | SharePoint | `Sites.FullControl.All` | Application | Have full control of all site collections |
    :::
 
 7. Click **Test Connection** to verify that Access Analyzer can authenticate to your SharePoint Online tenant. Resolve any failures before proceeding.
 
+   :::warning
+   After you upload a new certificate to your Entra ID application, Microsoft Entra ID can take several minutes to propagate the certificate to its token-issuing endpoints. If **Test Connection** fails with an error similar to `AADSTS700027: The certificate with identifier used to sign the client assertion is not registered on application` immediately after you upload a certificate, wait a few minutes and try again before troubleshooting further.
+   :::
+
 8. Click **Next**.
 
 9. Under **Scan Configuration**, configure the options for the scans you want to run:
 
    - **Include site URLs** — Limits the scan to specific site collections. Enter one URL per line. Leave empty to scan all sites in the tenant.
    - **Exclude site URLs** — Excludes specific site collections from the scan. Exclusions take precedence over inclusions.
-   - **Scan OneDrive** — When enabled, includes OneDrive personal site collections in the scan.
+   - **Scan OneDrive** — Includes OneDrive personal site collections in the scan.
 
    See [Scanning options](./scanning-options.md) for a full description of available scan types and options.
 
 10. Under **Scan Schedule**, select when to run the scan:
 
     - **Now** — Starts the scan immediately after setup completes.
     - **At** — Runs the scan once at a specific date and time.
-    - **Advanced** — Runs the scan on a recurring schedule defined by a cron expression.
+    - **Advanced** — Runs the scan on the recurring schedule you define with a cron expression.
 
 11. Click **Complete Setup**.
 
@@ -50,8 +69,8 @@ To check scan progress, navigate to **Configuration** > **Scan Executions**.
 
 ## Edit a source group
 
-To modify an existing SharePoint Online source group, navigate to **Configuration** > **Source Groups**, select the source group, and click **Edit**. The wizard reopens with your current configuration pre-populated. You can update the source group name, service account, tenant ID, scan configuration, and scan schedule.
+To modify an existing SharePoint Online source group, navigate to **Configuration** > **Source Groups**, select the source group, and click **Edit**. The wizard reopens and displays your current configuration. You can update the source group name, service account, tenant ID, scan configuration, and scan schedule.
 
 :::note
-Updating the service account replaces the certificate used to authenticate with SharePoint Online. Ensure the new service account's certificate is uploaded to your registered Entra ID application before saving.
+Updating the service account replaces the certificate that Access Analyzer uses to authenticate with SharePoint Online. Upload the new service account's certificate to your registered Entra ID application before saving.
 :::