Text as per Jaap's email

Author: Karuna-Mendix

content/en/docs/control-center/security/set-up-sso-byoidp.md

@@ -56,8 +56,10 @@ BYOIDP SSO integrates with the Mendix Platform using the following techniques:
     * This assumes that the IdP returns an email address to Mendix during SSO which the user previously used to sign up and log in to Mendix. If the email address that is returned to Mendix is not recognized, then the user will be offered the sign-up option to enable them to create a new account.
 * BYOIDP SSO makes an authentication request to your IdP which means that only the 'openid' and 'profile' scope values are requested, as defined by OIDC. The request does not explicitly ask for authorization for specific platform roles such as developer, Mendix Admin, or Technical Contact. You can set up your IdP, however, to apply coarse-grained access rules based on the `client_id` for the Mendix Platform to deny access to the Mendix Platform for certain groups of employees.
 * Mendix provides support for three client authentication methods: `client_secret_post` (client credentials in the payload), `client_secret_basic` (basic authentication credentials in the HTTP header), and `private_key_jwt` (using a client key-pair/certificate instead of a client secret). The Mendix platform will select `client_secret_post` if supported; otherwise, it will use `client_secret_basic`. The `private_key_jwt` method is available only to customers with a Premium platform license and requires onboarding by Mendix. For further assistance, contact your CSM.
-* Mendix includes the `login_hint` parameter in requests to your IdP This allows the IdP to pre-populate the login screen with the user's email address, which gives a better user experience. Your IdP may choose to ignore the hint. After receiving a positive response, Mendix does not do any validation if the logged-in user matches the login_hint.
+* Mendix includes the `login_hint` parameter in requests to your IdP. This allows the IdP to pre-populate the login screen with the user's email address, which gives a better user experience. Your IdP may choose to ignore the hint. After receiving a positive response, Mendix does not do any validation if the logged-in user matches the `login_hint`.
 * Whether or not users signing in to the Mendix Platform have to use 2FA does not change the [Two-Factor Authentication](/developerportal/deploy/two-factor-authentication/) which protects sensitive activities on Mendix Cloud nodes. This remains in place and works independently of BYOIDP SSO.
+* When using the BYOIDP feature to manage your Mendix Admins (see the [IdP-managed Mendix Admins](#idp-managed-mendix-admins) section of *Security Settings in Control Center*), the Mendix platform does not include anything specific in the SSO request (such as a specific scope value or claims request parameter). It expects that your IdP includes the required claim based on the configurations in your IdP for Mendix as a client.
+* Your group claim can have multiple values. Mendix checks the list to find the configured value.
 
 ### Limitations