diff --git a/changelog/unreleased/idp-directly-use-cs3-to-authenticate.md b/changelog/unreleased/idp-directly-use-cs3-to-authenticate.md
index f1f2833b5..5c80ecdab 100644
--- a/changelog/unreleased/idp-directly-use-cs3-to-authenticate.md
+++ b/changelog/unreleased/idp-directly-use-cs3-to-authenticate.md
@@ -1,5 +1,5 @@
-Enhancement: Directly authenticate users via CS3
+Enhancement: Allow authenticating users via CS3
 
-The IDP now directly authenticates users using the CS3 API instead of LDAP.
+The IDP can now directly authenticates users using the CS3 API by setting `IDP_IDENTITY_MANAGER="cs3"`.
 
 https://github.com/owncloud/ocis/pull/3825
diff --git a/extensions/idp/pkg/config/config.go b/extensions/idp/pkg/config/config.go
index 63345b4a8..a84c941c2 100644
--- a/extensions/idp/pkg/config/config.go
+++ b/extensions/idp/pkg/config/config.go
@@ -19,7 +19,7 @@ type Config struct {
 	HTTP HTTP `yaml:"http"`
 
 	Reva              *Reva  `yaml:"reva"`
-	MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY;IDP_MACHINE_AUTH_API_KEY"`
+	MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY;IDP_MACHINE_AUTH_API_KEY" desc:"Machine auth API key used to impersonate users when looking up their userinfo via the 'cs3' backend."`
 
 	Asset   Asset    `yaml:"asset"`
 	IDP     Settings `yaml:"idp"`
@@ -69,9 +69,9 @@ type Settings struct {
 	// don't change the order of elements in this struct
 	// it needs to match github.com/libregraph/lico/bootstrap.Settings
 
-	Iss string `yaml:"iss" env:"OCIS_URL;OCIS_OIDC_ISSUER;IDP_ISS"`
+	Iss string `yaml:"iss" env:"OCIS_URL;OCIS_OIDC_ISSUER;IDP_ISS" desc:"The OIDC issuer URL to use."`
 
-	IdentityManager string `yaml:"identity_manager" env:"IDP_IDENTITY_MANAGER"`
+	IdentityManager string `yaml:"identity_manager" env:"IDP_IDENTITY_MANAGER" desc:"The identity manager implementation to use, can be 'ldap', 'cs3', 'kc', 'libregraph', 'cookie' or 'guest'."`
 
 	URIBasePath string `yaml:"uri_base_path" env:"IDP_URI_BASE_PATH"`
 
@@ -81,7 +81,7 @@ type Settings struct {
 	AuthorizationEndpointURI string `yaml:"authorization_endpoint_uri" env:"IDP_ENDPOINT_URI"`
 	EndsessionEndpointURI    string `yaml:"end_session_endpoint_uri" env:"IDP_ENDSESSION_ENDPOINT_URI"`
 
-	Insecure bool `yaml:"insecure" env:"IDP_INSECURE"`
+	Insecure bool `yaml:"insecure" env:"IDP_INSECURE" desc:"Allow insecure connections to the backend."`
 
 	TrustedProxy []string `yaml:"trusted_proxy"` //TODO: how to configure this via env?
 
diff --git a/extensions/idp/pkg/config/reva.go b/extensions/idp/pkg/config/reva.go
index 2d3966303..5b4222251 100644
--- a/extensions/idp/pkg/config/reva.go
+++ b/extensions/idp/pkg/config/reva.go
@@ -2,5 +2,5 @@ package config
 
 // Reva defines all available REVA configuration.
 type Reva struct {
-	Address string `yaml:"address" env:"REVA_GATEWAY"`
+	Address string `yaml:"address" env:"REVA_GATEWAY" desc:"CS3 gateway used to authenticate and look up users"`
 }