From 65e6e5f09776676fcbada1541f9f64f2725a513e Mon Sep 17 00:00:00 2001
From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com>
Date: Tue, 3 Feb 2026 08:54:39 +0100
Subject: [PATCH] Enhance Set-ADUser documentation for
 PrincipalsAllowedToDelegateToAccount

Added information on specifying accounts from the same or different domains.
---
 docset/winserver2025-ps/ActiveDirectory/Set-ADUser.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docset/winserver2025-ps/ActiveDirectory/Set-ADUser.md b/docset/winserver2025-ps/ActiveDirectory/Set-ADUser.md
index 39fa62da04..52b99b8c1c 100644
--- a/docset/winserver2025-ps/ActiveDirectory/Set-ADUser.md
+++ b/docset/winserver2025-ps/ActiveDirectory/Set-ADUser.md
@@ -1230,6 +1230,8 @@ Accept wildcard characters: False
 Specifies an array of principal objects. This parameter sets the
 **msDS-AllowedToActOnBehalfOfOtherIdentity** attribute of a computer account object.
 
+You can specify the Distinguished Name of an account when it is from the same domain as the account in focus. When you want a security principal from another domain, you need to construct an ADPrincipal object with the desired account, for example using Get-ADGroup.
+
 ```yaml
 Type: ADPrincipal[]
 Parameter Sets: Identity