diff --git a/docs/hub/enterprise-scim.md b/docs/hub/enterprise-scim.md
index 9ff5dd96c..e2bfe832d 100644
--- a/docs/hub/enterprise-scim.md
+++ b/docs/hub/enterprise-scim.md
@@ -67,11 +67,14 @@ Once a SCIM group is linked to a Resource Group:
 
 ### SCIM-managed Resource Groups
 
-A Resource Group linked to a SCIM group is considered **SCIM-managed**. The IdP is the sole source of truth for its membership. As a result:
+A Resource Group linked to a SCIM group is considered **SCIM-managed**. The IdP is the sole source of truth for its regular users. As a result:
 
-- Manual membership changes via the Hub UI or API are **blocked** — any attempt to add, remove, or change a member's role on a SCIM-managed Resource Group will return a `403` error.
+- Manual membership changes via the Hub UI or API are **blocked** for regular users — any attempt to add, remove, or change the role of a regular user on a SCIM-managed Resource Group will return a `403` error.
+- [Service accounts](./enterprise-service-accounts) are the exception: since they are never provisioned through SCIM, you can still add, remove, or change the role of a service account manually on a SCIM-managed Resource Group.
 - Auto-join **cannot be enabled** on a SCIM-managed Resource Group. To re-enable auto-join, first remove the SCIM link.
 
+In the Resource Group settings, a SCIM-managed Resource Group displays a **SCIM synced** badge, and the membership form notes that only service accounts can be added or removed manually.
+
 Group provisioning works the same way for both Basic SSO and Managed SSO.
 
 ## Supported user attributes