diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md
index ea5e6ac591..ffe4fd0e2b 100644
--- a/docs/admin/authentication.md
+++ b/docs/admin/authentication.md
@@ -614,13 +614,13 @@ Impersonate-Extra-scopes: development
 ```
 
 When using `kubectl` set the `--as` flag to configure the `Impersonate-User`
-header.
+header, set the `--as-group` flag to configure the `Impersonate-Group` header.
 
 ```shell
 $ kubectl drain mynode
 Error from server (Forbidden): User "clark" cannot get nodes at the cluster scope. (get nodes mynode)
 
-$ kubectl drain mynode --as=superman
+$ kubectl drain mynode --as=superman --as-group=system:masters
 node "mynode" cordoned
 node "mynode" drained
 ```