Merge pull request #29479 from MicrosoftDocs/main

[AutoPublish] main to live - 09/17 19:46 PDT | 09/18 08:16 IST

Author: m365-skilling-repo-management[bot]

microsoft-365/admin/add-users/about-admin-roles.md

@@ -5,7 +5,7 @@ f1.keywords:
 ms.author: deniseb
 author: denisebmsft
 manager: dansimp
-ms.date: 04/02/2025
+ms.date: 09/17/2025
 audience: Admin
 ms.topic: how-to
 ms.service: microsoft-365-business
@@ -50,6 +50,9 @@ This article is for people who set password expiration policy for a business, sc
 
 You must be a [password administrator](about-admin-roles.md) to perform these steps.
 
+> [!IMPORTANT]
+> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. To learn more, see [About admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/about-admin-roles).
+
 ## Watch: Reset a business password for a user
 
 Check out this video and others on our [YouTube channel](https://go.microsoft.com/fwlink/?linkid=2198204).
@@ -151,12 +154,5 @@ Check out this great blog post by Vasil Michev, Microsoft MVP: [Force password c
     ```
 
 > [!NOTE]
-> The userPrincipalName must be in the Internet-style sign-in format where the user name is followed by the at sign (@) and a domain name. For example: [email protected].
+> The userPrincipalName must be in the Internet-style sign-in format where the user name is followed by the at sign (@) and a domain name. For example: `[email protected]`.
 
-## Related content
-  
-[Let users reset their own passwords](../add-users/let-users-reset-passwords.md) (article)\
-[Reset passwords](../add-users/reset-passwords.md) (article)\
-[Set an individual user's password to never expire](set-password-to-never-expire.md) (article)\
-[Set the password expiration policy for your organization](../manage/set-password-expiration-policy.md) (article)\
-[Microsoft 365 for business training videos](../../business-video/index.yml) (link page)

microsoft-365/admin/add-users/reset-passwords.md

@@ -19,6 +19,8 @@ ms.collection:
 - m365copilot
 - magic-ai-copilot
 - operations-pod
+ms.custom:
+- GAUpdates
 search.appverid:
 - MET150
 - MOE150
@@ -89,6 +91,8 @@ To use organizational messages in AI adoption score, you must be assigned one of
 - Global administrator
 - Organizational message writer
 
+[!INCLUDE [global-administrator-note](../../includes/global-administrator-note.md)]
+
 After selecting **Take action**, the following message configuration panel appears:
 
 :::image type="content" source="../../media/ai-as-org-message-create.png" alt-text="Screenshot the pane to create an organizational message for Copilot." lightbox="../../media/ai-as-org-message-create.png":::

microsoft-365/admin/adoption/ai-adoption-score.md

@@ -3,8 +3,8 @@ title: "Microsoft Adoption Score Organizational Messages"
 f1.keywords:
 - NOCSH
 ms.author: cmcatee
-author: camillepack
-manager: dansimp
+author: cmcatee-MSFT
+manager: scotv
 ms.date: 06/14/2024
 audience: Admin
 ms.topic: article
@@ -19,9 +19,9 @@ ms.collection:
 - Adm_TOC
 - operations-pod
 ms.custom:
-- AdminSurgePortfolio
 - AdminTemplateSet
 - campaignIDs-batch1
+- GAUpdates
 search.appverid:
 - MET150
 - MOE150
@@ -42,9 +42,10 @@ Organizational messages for Adoption Score will initially roll out to Communicat
 For a successful preview experience, you need to be one of the following admin roles:
 
 - Global administrator
-
 - Organizational message writer
 
+[!INCLUDE [global-administrator-note](../../includes/global-administrator-note.md)]
+
 The Organizational message writer role is the new built-in role that allows assigned admins to view and configure messages. The Global administrator can assign the Organizational message writer role to admins:
 
 1. Go to **Roles** \> **Role assignments**.

microsoft-365/admin/adoption/organizational-messages.md

@@ -3,8 +3,8 @@ title: "Microsoft Adoption Score - Privacy"
 f1.keywords:
 - NOCSH
 ms.author: cmcatee
-author: denisebmsft
-manager: dansimp
+author: cmcatee-MSFT
+manager: scotv
 ms.date: 09/18/2020
 audience: Admin
 ms.topic: article
@@ -18,7 +18,8 @@ ms.collection:
 - Adm_O365
 - trust-pod
 - operations-pod
-ms.custom: AdminSurgePortfolio
+ms.custom:
+- GAUpdates
 search.appverid:
 - MET150
 - MOE150

microsoft-365/admin/adoption/privacy.md

@@ -1,7 +1,7 @@
 ---
 title: "Prevent guests from being added to a specific group"
 ms.reviewer: rahulnayak
-ms.date: 12/02/2023
+ms.date: 09/17/2025
 author: officedocspr5
 ms.author: odocspr
 manager: jtremper
@@ -39,7 +39,8 @@ You must use the `beta` version of [Microsoft Graph PowerShell](/powershell/micr
 - If you've already installed the `beta` version, run `Update-Module Microsoft.Graph.Beta` to ensure it's the latest version of this module.
 
 > [!NOTE]
-> You must have global admin rights to run these commands.
+> You must have the Global Administrator role assigned in order to run these commands.
+> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role. To learn more, see [About admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/about-admin-roles).
 
 Run the following script, changing *\<GroupName\>* to the name of the group where you want to block guest access.
 
@@ -51,13 +52,13 @@ $templateId = (Get-MgBetaDirectorySettingTemplate | ? {$_.displayname -eq "group
 $groupID = (Get-MgBetaGroup -Filter "DisplayName eq '$GroupName'").Id
 
 $params = @{
-	templateId = "$templateId"
-	values = @(
-		@{
-			name = "AllowToAddGuests"
-			value = "$false"
-		}
-	)
+    templateId = "$templateId"
+    values = @(
+        @{
+            name = "AllowToAddGuests"
+            value = "$false"
+        }
+    )
 }
 
 New-MgBetaGroupSetting -GroupId $groupID -BodyParameter $params
@@ -82,13 +83,13 @@ $templateId = (Get-MgBetaDirectorySettingTemplate | ? {$_.displayname -eq "group
 $groupID = (Get-MgBetaGroup -Filter "DisplayName eq '$GroupName'").Id
 
 $params = @{
-	templateId = "$templateId"
-	values = @(
-		@{
-			name = "AllowToAddGuests"
-			value = $true
-		}
-	)
+    templateId = "$templateId"
+    values = @(
+        @{
+            name = "AllowToAddGuests"
+            value = $true
+        }
+    )
 }
 
 $DirectorySettingId = (Invoke-GraphRequest -Uri https://graph.microsoft.com/beta/Groups/$groupId/settings -Method GET).value.id
@@ -118,7 +119,7 @@ By default, guests aren't visible in the Exchange Global Address List. Use the s
    Update-MgBetaUser -UserId cfcbd1a0-ed18-4210-9b9d-cf0ba93cf6b2 -ShowInAddressList -GivenName 'Megan' -Surname 'Bowen' -DisplayName 'Megan Bowen' -mobilePhone '555-555-5555'
    ```
 
-## Related topics
+## Related articles
 
 [Collaboration governance planning recommendations](collaboration-governance-overview.md#collaboration-governance-planning-recommendations)