Update entra-id.mdx (#17695)

* Update entra-id.mdx

* Update entra-id.mdx

---------

Co-authored-by: ranbel <[email protected]>

Author: 2 people

src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx

@@ -139,6 +139,10 @@ SCIM requires a separate enterprise application from the one created during [ini
 
 5. Once the SCIM application is created, [assign users and groups to the application](https://learn.microsoft.com/entra/identity/enterprise-apps/assign-user-or-group-access-portal).
 
+	:::note
+	Groups in this SCIM application should match the groups in your other [Cloudflare Access enterprise application](/cloudflare-one/identity/idp-integration/entra-id/#set-up-entra-id-as-an-identity-provider). Because SCIM group membership updates will overwrite any groups in a user's identity, assigning the same groups to each app ensures consistent policy evaluation.
+	:::
+
 6. Go to **Provisioning** and select **Get started**.
 
 7. For **Provisioning Mode**, choose _Automatic_.