diff --git a/docs/administration/config-cheat-sheet.md b/docs/administration/config-cheat-sheet.md
index 4f8fd988..9220a97b 100644
--- a/docs/administration/config-cheat-sheet.md
+++ b/docs/administration/config-cheat-sheet.md
@@ -519,10 +519,14 @@ And the following unique queues:
   - `deletion`: User cannot delete their own account.
   - `manage_ssh_keys`: User cannot configure ssh keys.
   - `manage_gpg_keys`: User cannot configure gpg keys.
-- `EXTERNAL_USER_DISABLE_FEATURES`: **_empty_**: Comma separated list of disabled features ONLY if the user has an external login type (eg. LDAP, Oauth, etc.), could be `deletion`, `manage_ssh_keys`, `manage_gpg_keys`. This setting is independent from `USER_DISABLED_FEATURES` and supplements its behavior.
+  - `manage_mfa`: a User cannot configure mfa devices.
+  - `manage_credentials`: a user cannot configure emails, passwords, or openid
+- `EXTERNAL_USER_DISABLE_FEATURES`: **_empty_**: Comma separated list of disabled features ONLY if the user has an external login type (eg. LDAP, Oauth, etc.), could be `deletion`, `manage_ssh_keys`, `manage_gpg_keys`, `manage_mfa`, `manage_credentials`. This setting is independent from `USER_DISABLED_FEATURES` and supplements its behavior.
   - `deletion`: User cannot delete their own account.
   - `manage_ssh_keys`: User cannot configure ssh keys.
   - `manage_gpg_keys`: User cannot configure gpg keys.
+  - `manage_mfa`: a User cannot configure mfa devices.
+  - `manage_credentials`: a user cannot configure emails, passwords, or openid
 
 ## Security (`security`)