add service account consideration

[Muhammadsaeed707]

Documents that service accounts are exempt from the manual membership block on SCIM-managed Resource Groups, and adds a note about the SCIM synced badge in Resource Group settings.

Suggested by https://github.com/huggingface-internal/moon-landing/pull/18605.

---

Note

Low Risk
Documentation-only edits to enterprise SCIM guidance; no product or security behavior changes in this diff.

Overview
SCIM-managed Resource Groups documentation now states that the IdP is the source of truth for regular users only, not all membership.

Manual add/remove/role changes via Hub UI or API remain forbidden for regular users (403), but service accounts can still be managed manually because they are not SCIM-provisioned.

A new note describes Resource Group settings: SCIM synced badge and copy on the membership form that only service accounts can be changed by hand.

^{Reviewed by Cursor Bugbot for commit 22d88db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Updates the Enterprise SCIM documentation to clarify how SCIM-managed Resource Group membership behaves, specifically calling out the exception for service accounts and documenting the UI indicator shown in Resource Group settings.

Changes:

• Clarifies that SCIM is the source of truth for “regular” (non–service account) membership in SCIM-managed Resource Groups.
• Documents that manual membership changes are blocked for regular users but permitted for service accounts.
• Adds a note about the SCIM synced badge and the membership form messaging in Resource Group settings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[Charlie-Boyer]

lgtm with copilot comment

[Pierrci]

thanks!