From 456c5dbb4d6c64886abcacb425b7faf5a39de673 Mon Sep 17 00:00:00 2001
From: XingLu Wang <95828202+xingluw@users.noreply.github.com>
Date: Wed, 19 Jul 2023 06:09:08 -0700
Subject: [PATCH] Update iam.mdx (#3448)

* Update iam.mdx

* Update website/content/docs/concepts/iam.mdx

Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>

---------

Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
---
 website/content/docs/concepts/iam.mdx | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/website/content/docs/concepts/iam.mdx b/website/content/docs/concepts/iam.mdx
index 015ccd34b..383b139d1 100644
--- a/website/content/docs/concepts/iam.mdx
+++ b/website/content/docs/concepts/iam.mdx
@@ -41,6 +41,10 @@ method's identity provider to provide up-to-date information.
 [permissions](/boundary/docs/concepts/security/permissions) which are granted to any principal (user or group) from any scope. Roles
 can be contained by any scope, and the permissions can be applied to the same scope or any child scope.
 
+<Tip>
+Roles can only be applied to a single scope at a time in Boundary, meaning each scope requires its own role.
+</Tip>
+
 ## Access management
 
 ### Configure users - username/password
@@ -50,9 +54,9 @@ There are 3 steps to adding new users to Boundary using the password auth method
 3. In the same scope, create a new **user**, and then attach the new account to the new user. The user is now able to authenticate to Boundary.
 
 ### Configure users - OIDC/LDAP
-[OIDC](/boundary/tutorials/identity-management/oidc-auth) and LDAP accounts and users are auto-vivified (automatically generated) in Boundary in the same scope
-as the auth method. The accounts and users are only created once the user authenticates to Boundary for the first time. The same applies to OIDC/LDAP
-[managed groups](/boundary/tutorials/identity-management/oidc-idp-groups).
+With the [OIDC](/boundary/tutorials/identity-management/oidc-auth) and LDAP auth methods, Boundary uses data from the identity provider to automatically generate accounts and users in the same scope
+as the auth method. The accounts and users are only created once the user authenticates to Boundary for the first time. 
+The same applies to OIDC/LDAP [managed groups](/boundary/tutorials/identity-management/oidc-idp-groups).
 
 ### Grant permissions
 When setting up access controls for a user, it is important to first consider which scope(s) the user needs access to. **Each scope requires its own set of roles**,
@@ -108,4 +112,4 @@ Projects.
 <Tip>
 You can use the same roles across “Boundary Admin”, “Org_A Admin”, and “Project_1 Admin” since the scopes and grants are the same. The only difference is
 the users/groups that are added to each role.
-</Tip>
\ No newline at end of file
+</Tip>