fix readme indentation

Author: derisen

5-AccessControl/2-call-api-groups/README.md

@@ -1,6 +1,5 @@
 ---
 page_type: sample
-level: 300
 languages:
 - typescript
 - csharp
@@ -172,7 +171,7 @@ To manually register the apps, as a first step you'll need to:
  1. The generated key value will be displayed when you select the **Add** button. Copy and save the generated value for use in later steps.
  1. You'll need this key later in your code's configuration files. This key value will not be displayed again, and is not retrievable by any other means, so make sure to note it from the Azure portal before navigating to any other screen or blade.
  > :bulb: For enhanced security, instead of using client secrets, consider [using certificates](https://github.com/AzureAD/microsoft-identity-web/wiki/Certificates) and [Azure KeyVault](https://azure.microsoft.com/services/key-vault/#product-overview).
- 1. In the app's registration screen, select the **Expose an API** blade to the left to open the page where you can publish the permission as an API for which client applications can obtain [access tokens](https://aka.ms/access-tokens) for. The first thing that we need to do is to declare the unique [resource](https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) URI that the clients will be using to obtain access tokens for this API. To declare an resource URI(Application ID URI), follow the following steps:
+1. In the app's registration screen, select the **Expose an API** blade to the left to open the page where you can publish the permission as an API for which client applications can obtain [access tokens](https://aka.ms/access-tokens) for. The first thing that we need to do is to declare the unique [resource](https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) URI that the clients will be using to obtain access tokens for this API. To declare an resource URI(Application ID URI), follow the following steps:
  1. Select **Set** next to the **Application ID URI** to generate a URI that is unique for this app.
  1. For this sample, accept the proposed Application ID URI (`api://{clientId}`) by selecting **Save**. Read more about Application ID URI at [Validation differences by supported account types \(signInAudience\)](https://docs.microsoft.com/azure/active-directory/develop/supported-accounts-validation).
  
@@ -201,16 +200,18 @@ To manually register the apps, as a first step you'll need to:
  1. Select the **Add a permission** button and then:
  1. Ensure that the **My APIs** tab is selected.
  1. In the list of APIs, select the API `msal-angular-app`.
- * Since this app signs-in users, we will now proceed to select **delegated permissions**, which is is requested by apps when signing-in users.
-  1. In the **Delegated permissions** section, select **access_via_group_assignments** in the list. Use the search box if necessary.
+  1. Select **delegated permissions**, which is is requested by apps when signing-in users.
+ 1. In the **Delegated permissions** section, select **access_via_group_assignments** in the list. Use the search box if necessary.
  1. Select the **Add permissions** button at the bottom.
  1. Select the **Add a permission** button and then:
  1. Ensure that the **Microsoft APIs** tab is selected.
  1. In the *Commonly used Microsoft APIs* section, select **Microsoft Graph**
- * Since this app signs-in users, we will now proceed to select **delegated permissions**, which is is requested by apps when signing-in users.
-  1. In the **Delegated permissions** section, select **User.Read**, **GroupMember.Read.All** in the list. Use the search box if necessary.
+  1. Select **delegated permissions**, which is is requested by apps when signing-in users.
+ 1. In the **Delegated permissions** section, select **User.Read**, **GroupMember.Read.All** in the list. Use the search box if necessary.
  1. Select the **Add permissions** button at the bottom.
 
+> :warning: For the overage scenario, make sure you have granted **Admin Consent** for the MS Graph API's **GroupMember.Read.All** scope (see the **App Registration** steps above).
+
 ##### Configure Optional Claims
 
 1. Still on the same app registration, select the **Token configuration** blade to the left.