diff --git a/docs/user-management/advanced-user-search.mdx b/docs/user-management/advanced-user-search.mdx
index 3a2e797815b..4b2fbdc83ee 100644
--- a/docs/user-management/advanced-user-search.mdx
+++ b/docs/user-management/advanced-user-search.mdx
@@ -186,3 +186,40 @@ new URLSearchParams([
   ['joint', 'and'],
 ]);
 ```
+
+## Look up by external identity \{#look-up-by-external-identity}
+
+To find the user linked to a social or enterprise SSO identity, pass the following three query parameters together for an exact lookup:
+
+- `identityType`: `social` for a social connector identity, or `sso` for an enterprise SSO identity.
+- `identityProvider`: the connector target for a social identity (for example, `dingtalk`), or the issuer for an enterprise SSO identity.
+- `identityId`: the user identifier issued by the external identity provider.
+
+```javascript
+// Find the user linked to a DingTalk social identity
+new URLSearchParams([
+  ['identityType', 'social'],
+  ['identityProvider', 'dingtalk'],
+  ['identityId', 'dingtalk-open-id'],
+]);
+```
+
+```javascript
+// Find the user linked to an enterprise SSO identity
+new URLSearchParams([
+  ['identityType', 'sso'],
+  ['identityProvider', 'https://example.com/issuer'],
+  ['identityId', 'enterprise-user-id'],
+]);
+```
+
+The identity filter is combined with other search filters using AND logic. For example, to further narrow the identity lookup with a keyword search:
+
+```javascript
+new URLSearchParams([
+  ['identityType', 'social'],
+  ['identityProvider', 'dingtalk'],
+  ['identityId', 'dingtalk-open-id'],
+  ['search', '%foo%'],
+]);
+```