diff --git a/docs/en/compute-edition/32/admin-guide/agentless-scanning/agentless-scanning-modes.adoc b/docs/en/compute-edition/32/admin-guide/agentless-scanning/agentless-scanning-modes.adoc
index acc247e73c..6daccee2fd 100644
--- a/docs/en/compute-edition/32/admin-guide/agentless-scanning/agentless-scanning-modes.adoc
+++ b/docs/en/compute-edition/32/admin-guide/agentless-scanning/agentless-scanning-modes.adoc
@@ -43,6 +43,16 @@ For example, you don't need to replicate networking configuration across target
 
 Scanners in the hub account scan target accounts independently. An agentless scanner in the hub account only scans snapshots from one target account and this ensures segregation between target accounts.
 
+[NOTE]
+====
+For GCP accounts with organizations only: Even if the IAM permissions template successfully applies the permissions needed for the target account, they can still be overridden by Organizational policies. The permissions check that is part of the scanning mechanism will only check that the Organization project, and that the target project has the needed permissions to perform scans. If you experience permissions issues with scans, please check the IAM policy calculator in GCP, and the VPC Service Control Troubleshooter.
+====
+
+[NOTE]
+====
+For GCP accounts with organizations only: The target account should have its own service account associated with it. Using the same service account key with two accounts will not work properly.
+====
+
 The following diagram gives a high level view of agentless scanning in hub account mode.
 
 image::agentless-scanning-hub-account-mode.png[width=800]
@@ -82,4 +92,4 @@ You can still correlate the costs each target account incurs using CSPs costs an
 This is the default mode to help you get started as soon as you complete onboarding.
 |Additional configuration required for each account after you complete onboarding your accounts.
 
-|===
\ No newline at end of file
+|===