diff --git a/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md b/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md
index 5e7392c4ff..6d2a567cf4 100644
--- a/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md
+++ b/datacenter/ucp/2.2/guides/admin/configure/run-only-the-images-you-trust.md
@@ -43,12 +43,19 @@ With this setting, UCP allows deploying any image as long as the image has
 been signed. It doesn't matter who signed the image.
 
 To enforce that the image needs to be signed by specific teams, click the
-dropdown and select those teams from the list.
+dropdown and select those teams from the list. 
+
+> Team must be in docker-datacenter
+>
+> You need to select a team that's part of the `docker-datacenter` organization
+> in order to use this feature.
+{: .important}
 
 ![UCP settings](../../images/run-only-the-images-you-trust-3.png){: .with-border}
 
 If you specify multiple teams, the image needs to be signed by a member of each
-team, or someone that is a member of all those teams.
+team, or someone that is a member of all those teams, again which must be a part
+of the `docker-datacenter` organization.
 
 > Signing with teams
 >