diff --git a/server_admin/keycloak-images/saml-add-identity-provider.png b/server_admin/keycloak-images/saml-add-identity-provider.png
index ce19230f30..42ac4990d4 100644
Binary files a/server_admin/keycloak-images/saml-add-identity-provider.png and b/server_admin/keycloak-images/saml-add-identity-provider.png differ
diff --git a/server_admin/topics/identity-broker/saml.adoc b/server_admin/topics/identity-broker/saml.adoc
index c36fedc145..6c4c587143 100644
--- a/server_admin/topics/identity-broker/saml.adoc
+++ b/server_admin/topics/identity-broker/saml.adoc
@@ -34,11 +34,14 @@ You must define the SAML configuration options as well.  They basically describe
 |Specifies the URI reference corresponding to a name identifier format. Defaults to `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`.
 
 |Principal Type
-|Specifies which part of the SAML assertion will be used to identify and track external user identities. Can be either Subject NameID or SAML attribute (either by name or by friendly name).
+|Specifies which part of the SAML assertion will be used to identify and track external user identities. Can be either Subject NameID or SAML attribute (either by name or by friendly name). Subject NameID value can not be set together with 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient' NameID Policy Format value.
 
 |Principal Attribute
 |If Principal is set to either "Attribute [Name]" or "Attribute [Friendly Name]", this field will specify the name or the friendly name of the identifying attribute, respectively.
 
+|Allow create
+|Allow the external identity provider to create a new identifier to represent the principal.
+
 |HTTP-POST Binding Response
 |When this realm responds to any SAML requests sent by the external IDP, which SAML binding should be used?  If set to `off`, then the Redirect Binding will be used.