Update hdinsight-migrate-granular-access-cluster-configurations.md

tylerfox · tylerfox · commit 88171ff555e6 · 2019-08-09T09:21:18.000-07:00
diff --git a/articles/hdinsight/hdinsight-migrate-granular-access-cluster-configurations.md b/articles/hdinsight/hdinsight-migrate-granular-access-cluster-configurations.md
@@ -6,7 +6,7 @@ ms.author: tyfox
 ms.reviewer: jasonh
 ms.service: hdinsight
 ms.topic: conceptual
-ms.date: 06/03/2019
+ms.date: 08/09/2019
 ---
     
 # Migrate to granular role-based access for cluster configurations
@@ -17,9 +17,9 @@ We are introducing some important changes to support more fine-grained role-base
 
 Previously, secrets could be obtained via the HDInsight API by cluster users
 possessing the Owner, Contributor, or Reader [RBAC
-roles](https://docs.microsoft.com/azure/role-based-access-control/rbac-and-directory-admin-roles), as they were available to anyone with the `*/read` permission.
-Going forward, accessing these secrets will require the `Microsoft.HDInsight/clusters/configurations/*` permission, meaning they can no longer be accessed by users with the
-Reader role. Secrets are defined as values that could be used to obtain more elevated access than a user's role should allow. These include values such as cluster gateway HTTP credentials, storage account keys, and database credentials.
+roles](https://docs.microsoft.com/azure/role-based-access-control/rbac-and-directory-admin-roles), as they were available to anyone with the `*/read` permission. Secrets are defined as values that could be used to obtain more elevated access than a user's role should allow. These include values such as cluster gateway HTTP credentials, storage account keys, and database credentials.
+
+Going forward, accessing these secrets will require the `Microsoft.HDInsight/clusters/configurations/action` permission, meaning they can no longer be accessed by users with the Reader role. The roles that have this permission are Contributor, Owner, and the new HDInsight Cluster Operator role (more on that below).
 
 We are also introducing a new [HDInsight Cluster Operator](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#hdinsight-cluster-operator) role
 that will be able to retrieve secrets without being granted the administrative
@@ -204,4 +204,4 @@ The `GET /configurations` and `POST /configurations/gateway` will no longer retu
 
 If you are using an older version of one of the tools for Visual Studio, VSCode, IntelliJ or Eclipse mentioned above, they will no longer function until you update.
 
-For more detailed information, see the corresponding section of this document for your scenario.
+For more detailed information, see the corresponding section of this document for your scenario.
