diff --git a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters.mdx b/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters.mdx
index c7830af27a94c1..91a4d4909e8d35 100644
--- a/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters.mdx
+++ b/src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters.mdx
@@ -47,7 +47,7 @@ You can use the following parameters to configure a specific Zero Trust organiza
 
 ### `auth_client_id`
 
-Enrolls the device in your Zero Trust organization using a [service token](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token).
+Enrolls the device in your Zero Trust organization using a [service token](/cloudflare-one/identity/service-tokens/#create-a-service-token).
 Requires the `auth_client_secret` parameter.
 
 **Value Type:** `string`
@@ -63,9 +63,13 @@ Example configuration:
 <string>bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5</string>
 ```
 
+:::note
+The service token must have _Service Auth_ [device enrollment permissions](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token). Allow permissions will not work for service tokens.
+:::
+
 ### `auth_client_secret`
 
-Enrolls the device in your Zero Trust organization using a [service token](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token).
+Enrolls the device in your Zero Trust organization using a [service token](/cloudflare-one/identity/service-tokens/#create-a-service-token).
 Requires the `auth_client_id` parameter.
 
 **Value Type:** `string`
@@ -282,4 +286,4 @@ An optional property. `is_browser` will help the Cloudflare One Agent applicatio
 
 **Value Type**: `boolean`
 
-**Value**: If the value is `true`, identifies the application defined in `app_identifier` as a browser. The default value is `false` and `is_browser` is an optional property.
\ No newline at end of file
+**Value**: If the value is `true`, identifies the application defined in `app_identifier` as a browser. The default value is `false` and `is_browser` is an optional property.