diff --git a/docs/Configuration/yaml-files.md b/docs/Configuration/yaml-files.md
index c228d8fb057..bfb0566460a 100644
--- a/docs/Configuration/yaml-files.md
+++ b/docs/Configuration/yaml-files.md
@@ -346,6 +346,17 @@ The `controls` section allows you to configure scripts and device management (MD
 - `windows_enabled_and_configured` specifies whether or not to turn on Windows MDM features (default: `false`). Can only be configured for "All fleets" (`default.yml`).
 - `windows_entra_tenant_ids` is a list of Microsoft Entra tenant IDs to enable automatic (Autopilot) and manual enrollment by end users (**Settings** > **Accounts** > **Access work or school** on Windows). Can only be configured for "All fleets" (`default.yml`). Find your **Tenant ID**, on [**Microsoft Entra ID** > **Home**](https://entra.microsoft.com/#home).
 - `windows_entra_client_ids` is a list of Microsoft Entra application (client) IDs for the applications used to enroll Windows hosts via Microsoft Entra. Set this when you set up Entra enrollment: Microsoft Entra issues v2 access tokens whose audience is the application's client ID, so Fleet needs the client ID to authorize enrollment. Can only be configured for "All fleets" (`default.yml`). Find your **Application (client) ID** on [**Microsoft Entra ID** > **App registrations**](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) > your MDM application > **Overview**.
+- `microsoft_graph_credentials` is a list of Microsoft Graph API client credentials used to authenticate requests to the Microsoft Graph API. Fleet uses these to sync Windows Autopilot-registered devices so they appear as pending hosts before they enroll.
+  Each entry contains:
+  - `tenant_id` is the Microsoft Entra tenant ID. Must match one of the
+  `windows_entra_tenant_ids` above (default: `""`).
+  - `client_id` is the application (client) ID of the Entra app registration
+  (default: `""`).
+  - `client_secret` is the client secret for the Entra app registration
+  (default: `""`).
+Can only be configured for "All fleets" (`default.yml`). Configure this in
+**Settings > Integrations > MDM > Microsoft Entra**. Find your credentials on
+[Microsoft Entra ID > App registrations > your MDM application](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade).
 - `enable_turn_on_windows_mdm_manually` specifies whether or not to require end users to sign in using **Settings > Access work or school** (default: `false`). If `false`, MDM is automatically turned on for all Windows hosts that aren't connected to any MDM solution. Either method results in an MDM status of "On (manual)". To get a status of "On (company-owned)", use [Windows Autopilot](https://fleetdm.com/guides/windows-mdm-setup#windows-autopilot). Can only be configured for "All fleets" (`default.yml`).
 - `windows_migration_enabled` specifies whether or not to automatically migrate Windows hosts connected to another MDM solution. If `false`, MDM is only turned on after hosts are unenrolled from your old MDM solution. `enable_turn_on_windows_mdm_manually` must be set to `false`. (default: `false`). Can only be configured for "All fleets" (`default.yml`).
 - `windows_require_bitlocker_pin` specifies whether or not to require end users on Windows hosts to set a BitLocker PIN. When set, this PIN is required to unlock Windows hosts during startup. `windows_settings.enable_disk_encryption` must be set to `true`. (default: `false`).
@@ -370,6 +381,10 @@ controls:
     - 4e342a0d-ec1a-4353-bdeb-785542e0a8fb
   windows_entra_client_ids:
     - 8c8e3fd4-9b2c-4d3e-8f10-2233445566aa
+  microsoft_graph_credentials: # Available in Fleet Premium
+    - tenant_id: 4e342a0d-ec1a-4353-bdeb-785542e0a8fb
+      client_id: 122349c0-9b2c-4d3e-8f10-aabbccddeeff
+      client_secret: $MICROSOFT_GRAPH_CLIENT_SECRET
   enable_turn_on_windows_mdm_manually: false # Available in Fleet Premium
   windows_migration_enabled: true # Available in Fleet Premium
   apple_require_hardware_attestation: false # Available in Fleet Premium