diff --git a/README-NGTS.md b/README-NGTS.md
index c1c9768..8007eb8 100644
--- a/README-NGTS.md
+++ b/README-NGTS.md
@@ -87,7 +87,7 @@ conn = venafi_connection(
 |---|---|---|
 | `client_id` | yes¹ | Service-account Client ID used to obtain an access token. |
 | `client_secret` | yes¹ | Service-account Client Secret used to obtain an access token. |
-| `tsg_id` | yes² | Tenant Service Group ID. Used to derive the OAuth scope as `tsg_id:<TSG_ID>`. |
+| `tsg_id` | yes² | Tenant Service Group ID. Used to derive the OAuth scope as `tsg_id:<TSG_ID>`. Can be any TSG the service account is authorized for, including a sub-TSG — not just the TSG it was originally created under. |
 | `scope` | yes² | OAuth scope (e.g. `tsg_id:<TSG_ID>`). Takes precedence over `tsg_id` when supplied. |
 | `access_token` | no¹ | A pre-issued OAuth access token. When supplied, `client_id`/`client_secret` become optional (but are still used to refresh the token if present). |
 | `token_url` | no | OAuth token endpoint. Defaults to the Palo Alto production endpoint (see below); override it for non-production environments. |