diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md
index 12320e2fa8..4e4efe3f98 100644
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md
@@ -12,14 +12,16 @@ For more information about API Management access:
 
 The permission strings below are Azure RBAC operations for the `Microsoft.ApiManagement` resource provider. Their documented effects are used to distinguish read, secret-retrieval, write, and network-configuration capabilities.<sup>[[1]](#references)</sup>
 
-## `Microsoft.ApiManagement/service/users/token/action`
+## `Microsoft.ApiManagement/service/users/generateSsoUrl/action`
 
-**Minimum permissions:** `Microsoft.ApiManagement/service/users/token/action`
+**Minimum permissions:** `Microsoft.ApiManagement/service/users/generateSsoUrl/action` on the selected user.
 
 **Potential Impact:** Generates an SSO URL with a token that logs in as a chosen developer-portal user, inheriting that user's API subscriptions and portal visibility (not an Azure control-plane token; unavailable on Consumption tier).
 
 On tiers with developer users, this operation generates an SSO URL containing a token that signs in as the selected developer-portal user:
 
+`Microsoft.ApiManagement/service/users/token/action` is a separate operation that retrieves a shared access token.
+
 ```bash
 az rest --method POST \
   --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service>/users/<user-id>/generateSsoUrl?api-version=2022-08-01"
diff --git a/src/privilege-escalation-paths/azure/adjacent_principals.yaml b/src/privilege-escalation-paths/azure/adjacent_principals.yaml
index a9397be841..7c610f7eff 100644
--- a/src/privilege-escalation-paths/azure/adjacent_principals.yaml
+++ b/src/privilege-escalation-paths/azure/adjacent_principals.yaml
@@ -6,7 +6,7 @@
   provider: azure
   service: api_management
   title: Sign in as one named API Management developer-portal user
-  source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md#microsoftapimanagementserviceuserstokenaction
+  source: src/pentesting-cloud/azure-security/az-privilege-escalation/az-api-management-privesc.md#microsoftapimanagementserviceusersgeneratessourlaction
   source_revision: db5b136660
   summary: A generated SSO URL can reach the exact requested portal user only when its token is usable and newly grants a named portal or subscription action.
   requires: