Merge pull request #29468 from MicrosoftDocs/main

[AutoPublish] main to live - 09/17 13:30 PDT | 09/18 02:00 IST

Author: m365-skilling-repo-management[bot]

microsoft-365/commerce/subscriptions/manage-self-service-purchases-admins.md

@@ -4,8 +4,8 @@ f1.keywords:
 - NOCSH
 author: cmcatee-MSFT
 ms.author: cmcatee
-manager: dansimp
-ms.reviewer: schyevan, ramagane
+manager: scotv
+ms.reviewer: smithk, ramagane
 audience: Admin
 ms.topic: how-to
 ms.service: microsoft-365-business

microsoft-365/services/pay-as-you-go-budget.md

@@ -4,7 +4,7 @@ ms.author: chucked
 author: chuckedmonson
 manager: jtremper
 ms.reviewer: ivchenya
-ms.date: 08/07/2025
+ms.date: 09/17/2025
 audience: admin
 ms.topic: install-set-up-deploy
 ms.service: microsoft-365-business
@@ -26,12 +26,17 @@ Budgets are set at the billing policy level, not for individual users, agents, o
 To access the Microsoft 365 admin center, users must be assigned one of the following roles:
 
 - [Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator)
+
 - [AI Administrator](/entra/identity/role-based-access-control/permissions-reference?#ai-administrator)
+
 - [Global Reader](/entra/identity/role-based-access-control/permissions-reference#global-reader)
 
     > [!NOTE]
     > Users with the [Global Reader](/entra/identity/role-based-access-control/permissions-reference#global-reader) role can view billing policies and budgets, but they can't view spending data.
 
+    > [!IMPORTANT]
+    > Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role. To learn more, see [About admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/about-admin-roles).
+
 ## Set up a budget
 
 1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/Adminportal/Home).

microsoft-365/services/pay-as-you-go-setup-copilot.md

@@ -4,7 +4,7 @@ ms.author: chucked
 author: chuckedmonson
 manager: jtremper
 ms.reviewer: siruvanti
-ms.date: 07/11/2025
+ms.date: 09/17/2025
 audience: admin
 ms.topic: install-set-up-deploy
 ms.service: microsoft-365-business
@@ -83,11 +83,12 @@ After setting up billing, you can [set up a budget and monitor your usage in the
 
 - Ensure you have one of the following Microsoft 365 administrator roles:
 
-    - Global administrator
-    - Billing administrator
-    - AI administrator
+    - [Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator)
+    - [Billing Administrator](/entra/identity/role-based-access-control/permissions-reference#billing-administrator)
+    - [AI Administrator](/entra/identity/role-based-access-control/permissions-reference?#ai-administrator)
 
-To learn more about these roles, see [Microsoft 365 admin roles](/microsoft-365/admin/add-users/about-admin-roles).
+    > [!IMPORTANT]
+    > Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role. To learn more, see [About admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/about-admin-roles).
 
 ### Disconnect agents from pay-as-you-go billing
 

microsoft-365/services/pay-as-you-go-setup.md

@@ -4,7 +4,7 @@ ms.author: chucked
 author: chuckedmonson
 manager: jtremper
 ms.reviewer: siruvanti
-ms.date: 08/01/2025
+ms.date: 09/17/2025
 audience: admin
 ms.topic: install-set-up-deploy
 ms.service: microsoft-365-business
@@ -71,8 +71,12 @@ After setup, monitor your pay-as-you-go usage and costs in [Microsoft Cost Manag
 Ensure you have the following roles:
 
 - [SharePoint Administrator](/entra/identity/role-based-access-control/permissions-reference#sharepoint-administrator) or [Global Administrator](/entra/identity/role-based-access-control/permissions-reference#global-administrator) for accessing the Microsoft 365 admin center
+
 - Owner or Contributor rights to the Azure subscription and resource group
 
+    > [!IMPORTANT]
+    > Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role. To learn more, see [About admin roles in the Microsoft 365 admin center](/microsoft-365/admin/add-users/about-admin-roles).
+
 ### Step 1: Access manage billing
 
 1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/Adminportal/Home).