@@ -158,6 +158,14 @@ extends:
             targetType: 'filePath'
             pwsh: true
             filePath: scripts/CorrectRelatedLinks-AllFiles.ps1
+        - task: PowerShell@2
+          displayName: 'Stabilize ms.date values'
+          continueOnError: false
+          inputs:
+            targetType: 'filePath'
+            pwsh: true
+            filePath: scripts/StabilizeMsDate.ps1
+            errorActionPreference: 'stop'
         - task: PowerShell@2
           displayName: Pushing to github
           env:
 
@@ -19,20 +19,37 @@ function Start-Generator {
             $DelegatedPersonalPermissions = @();
             #Get Permissions
             $Permissions = $_.Permissions;
+            # Collect permissions with their privilege level for sorting
+            $DWPermsWithPrivilege = @();
+            $AppPermsWithPrivilege = @();
+            $DPPermsWithPrivilege = @();
             $Permissions | ForEach-Object {
                 $Permission = $_;
                 $PermissionName = $Permission.Name;
                 $PermissionType = $Permission.PermissionType;
+                $IsLeast = $Permission.IsLeastPrivilege -eq $true -or $Permission.IsLeastPrivilege -eq "True";
+                $entry = [PSCustomObject]@{ Name = $PermissionName; IsLeastPrivilege = $IsLeast }
                 if ($PermissionType -eq "DelegatedWork") {
-                    $DelegatedWorkPermissions += $PermissionName;
+                    $DWPermsWithPrivilege += $entry;
                 }
                 elseif ($PermissionType -eq "Application") {
-                    $ApplicationPermissions += $PermissionName;
+                    $AppPermsWithPrivilege += $entry;
                 }
                 elseif ($PermissionType -eq "DelegatedPersonal") {
-                    $DelegatedPersonalPermissions += $PermissionName;
+                    $DPPermsWithPrivilege += $entry;
                 }
             }
+            # Sort: least privileged first, then alphabetically within each group
+            # Deduplicate by name to avoid repeated entries
+            $DelegatedWorkPermissions = $DWPermsWithPrivilege |
+                Sort-Object @{Expression={-not $_.IsLeastPrivilege}}, @{Expression={$_.Name}} |
+                Select-Object -ExpandProperty Name -Unique;
+            $ApplicationPermissions = $AppPermsWithPrivilege |
+                Sort-Object @{Expression={-not $_.IsLeastPrivilege}}, @{Expression={$_.Name}} |
+                Select-Object -ExpandProperty Name -Unique;
+            $DelegatedPersonalPermissions = $DPPermsWithPrivilege |
+                Sort-Object @{Expression={-not $_.IsLeastPrivilege}}, @{Expression={$_.Name}} |
+                Select-Object -ExpandProperty Name -Unique;
             #If its already in the list, skip it
             if ($CmdList -notcontains $CommandName) {
                 #Check if all types of permissions in the their respective arrays are empty. If empty just skip the command
 
@@ -0,0 +1,52 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#
+# Reverts files where the only change compared to HEAD is the ms.date
+# metadata line. This prevents date-only churn from inflating PR diffs.
+
+$ErrorActionPreference = 'Stop'
+
+Write-Host -ForegroundColor Green "-------------Stabilizing ms.date values-------------"
+
+$modifiedFiles = git diff --name-only -- '*.md'
+if ($LASTEXITCODE -ne 0) {
+    Write-Error "git diff --name-only failed with exit code $LASTEXITCODE"
+}
+
+$revertedCount = 0
+
+foreach ($file in $modifiedFiles) {
+    if ([string]::IsNullOrWhiteSpace($file)) { continue }
+    if (-not (Test-Path $file)) { continue }
+
+    # Get the raw diff with no context, then extract only +/- content lines
+    $rawDiff = git diff --unified=0 -- $file
+    # Filter to content change lines only (skip headers, hunk markers, and
+    # special markers like "\ No newline at end of file")
+    $diffLines = $rawDiff | Where-Object {
+        ($_ -match '^\+[^+]' -or $_ -match '^\-[^-]') -and $_ -notmatch '^\\ '
+    }
+
+    # Check if all changed lines are ms.date changes
+    $allMsDate = $true
+    $hasChanges = $false
+    foreach ($line in $diffLines) {
+        $hasChanges = $true
+        if ($line -notmatch '^[+-]ms\.date: ') {
+            $allMsDate = $false
+            break
+        }
+    }
+
+    if ($hasChanges -and $allMsDate) {
+        git checkout -- $file
+        if ($LASTEXITCODE -ne 0) {
+            Write-Warning "Failed to revert $file (exit code $LASTEXITCODE)"
+        } else {
+            $revertedCount++
+        }
+    }
+}
+
+Write-Host "Reverted $revertedCount file(s) with date-only changes."
+Write-Host -ForegroundColor Green "-------------Done stabilizing ms.date-------------"