diff --git a/EXAMPLES.md b/EXAMPLES.md
index 32f64f0..e6ada6b 100644
--- a/EXAMPLES.md
+++ b/EXAMPLES.md
@@ -320,6 +320,13 @@ module "quilt" {
 
 ## Authentication Examples
 
+> **Note:** These examples use per-provider parameters (`GoogleAuth`, `AzureAuth`, etc.), which
+> apply to stacks built with `multi_sso: true`. If your stack has a `SingleSignOnProvider` dropdown
+> in its CloudFormation parameters, it was built with `multi_sso: false` and uses a different set of
+> parameters — see the
+> [SSO configuration in the technical reference](https://docs.quiltdata.com/technical-reference#enabling-sso)
+> instead. The deployment method (Terraform, Console, CLI) does not determine which format applies.
+
 ### Google OAuth Integration
 
 ```hcl
diff --git a/VARIABLES.md b/VARIABLES.md
index 00b2aa1..0ea262d 100644
--- a/VARIABLES.md
+++ b/VARIABLES.md
@@ -77,6 +77,13 @@ The `parameters` map configures the Quilt application. Here are all available pa
 
 ### Authentication Parameters
 
+> **Note:** These parameters apply to stacks built with `multi_sso: true` (per-provider format).
+> Stacks built with `multi_sso: false` use a different set:
+> `SingleSignOnProvider`, `SingleSignOnClientId`, `SingleSignOnClientSecret`, and `SingleSignOnBaseUrl`.
+> To determine which format your stack uses, check your stack's CloudFormation parameters for a
+> `SingleSignOnProvider` dropdown — if present, use those parameters instead.
+> See the [SSO configuration in the technical reference](https://docs.quiltdata.com/technical-reference#enabling-sso).
+
 | Parameter | Description | Values | Default |
 |-----------|-------------|--------|---------|
 | `PasswordAuth` | Enable username/password authentication | `"Enabled"`, `"Disabled"` | `"Enabled"` |