diff --git a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
index 31aeaa1a99a..20943365830 100644
--- a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md
@@ -219,24 +219,25 @@ For more information on Cloud Access Policies and how to use them, see [Access p
### Grafana Alerting Notification action definitions
-| Action | Applicable scopes | Description |
-| -------------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------- |
-| `alert.notifications.receivers:read` | `receivers:*`
`receivers:uid:*` | Read contact points. |
-| `alert.notifications.receivers.secrets:read` | `receivers:*`
`receivers:uid:*` | Export contact points with decrypted secrets. |
-| `alert.notifications.receivers:create` | None | Create a new contact points. The creator is automatically granted full access to the created contact point. |
-| `alert.notifications.receivers:write` | `receivers:*`
`receivers:uid:*` | Update existing contact points. |
-| `alert.notifications.receivers:delete` | `receivers:*`
`receivers:uid:*` | Update and delete existing contact points. |
-| `alert.notifications.receivers:test` | None | Test contact point notification. |
-| `receivers.permissions:read` | `receivers:*`
`receivers:uid:*` | Read permissions for contact points. |
-| `receivers.permissions:write` | `receivers:*`
`receivers:uid:*` | Manage permissions for contact points. |
-| `alert.notifications.time-intervals:read` | None | Read mute time intervals. |
-| `alert.notifications.time-intervals:write` | None | Create new or update existing mute time intervals. |
-| `alert.notifications.time-intervals:delete` | None | Delete existing time intervals. |
-| `alert.notifications.templates:read` | None | Read templates. |
-| `alert.notifications.templates:write` | None | Create new or update existing templates. |
-| `alert.notifications.templates:delete` | None | Delete existing templates. |
-| `alert.notifications.routes:read` | None | Read notification policies. |
-| `alert.notifications.routes:write` | None | Create new, update or delete notification policies |
+| Action | Applicable scopes | Description |
+| ----------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `alert.notifications.receivers:read` | `receivers:*`
`receivers:uid:*` | Read contact points. |
+| `alert.notifications.receivers.secrets:read` | `receivers:*`
`receivers:uid:*` | Export contact points with decrypted secrets. |
+| `alert.notifications.receivers:create` | None | Create a new contact points. The creator is automatically granted full access to the created contact point. |
+| `alert.notifications.receivers:write` | `receivers:*`
`receivers:uid:*` | Update existing contact points. |
+| `alert.notifications.receivers.protected:write` | `receivers:*`
`receivers:uid:*` | Update [protected fields](/docs/grafana//alerting/configure-notifications/manage-contact-points#grafana-cloud-protected-fields) in contact points (such as target URLs for integrations). This scope only applies to Grafana Cloud. |
+| `alert.notifications.receivers:delete` | `receivers:*`
`receivers:uid:*` | Update and delete existing contact points. |
+| `alert.notifications.receivers:test` | None | Test contact point notification. |
+| `receivers.permissions:read` | `receivers:*`
`receivers:uid:*` | Read permissions for contact points. |
+| `receivers.permissions:write` | `receivers:*`
`receivers:uid:*` | Manage permissions for contact points. |
+| `alert.notifications.time-intervals:read` | None | Read mute time intervals. |
+| `alert.notifications.time-intervals:write` | None | Create new or update existing mute time intervals. |
+| `alert.notifications.time-intervals:delete` | None | Delete existing time intervals. |
+| `alert.notifications.templates:read` | None | Read templates. |
+| `alert.notifications.templates:write` | None | Create new or update existing templates. |
+| `alert.notifications.templates:delete` | None | Delete existing templates. |
+| `alert.notifications.routes:read` | None | Read notification policies. |
+| `alert.notifications.routes:write` | None | Create new, update or delete notification policies |
### Grafana Synthetic Monitoring action definitions
diff --git a/docs/sources/alerting/configure-notifications/manage-contact-points/_index.md b/docs/sources/alerting/configure-notifications/manage-contact-points/_index.md
index c04939f16b0..a468c91449d 100644
--- a/docs/sources/alerting/configure-notifications/manage-contact-points/_index.md
+++ b/docs/sources/alerting/configure-notifications/manage-contact-points/_index.md
@@ -137,6 +137,23 @@ On the **Contact Points** tab, you can:
Contact points are assigned to a [specific Alertmanager](ref:configure-alertmanager) and cannot be used by notification policies in other Alertmanagers.
{{< /admonition >}}
+## Grafana Cloud Protected fields
+
+For Grafana Cloud users, contact points may contain protected fields that require admin permissions to modify. Protected fields are sensitive configuration settings that affect where notifications are sent, such as:
+
+- Target URLs for integrations (webhooks, PagerDuty, Opsgenie, or other integrations.)
+- API endpoints
+- Other destination-related settings
+
+These fields are protected to prevent unauthorized users from redirecting notifications to compromised servers, which could expose sensitive information such as authorization tokens, API keys, or alert data.
+
+Users with edit permissions can modify most contact point settings and can add or remove integrations, but cannot change protected fields in existing integrations. Only users with admin permissions to the contact point can update protected fields.
+
+The ability to modify protected fields is controlled by the RBAC action `alert.notifications.receivers.protected:write`. This role is granted by default to:
+
+- Users with the fixed "Alerting Admin" role
+- Users with admin permissions for the specific contact point
+
## Supported contact point integrations
Each contact point integration has its own configuration options and setup process. The following list shows the contact point integrations supported by Grafana.
diff --git a/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-alertmanager.md b/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-alertmanager.md
index 9f5822eedc6..4cdc84ec366 100644
--- a/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-alertmanager.md
+++ b/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-alertmanager.md
@@ -59,9 +59,9 @@ For more details on contact points, including how to test them and enable notifi
## Alertmanager settings
-| Option | Description |
-| ------ | --------------------- |
-| URL | The Alertmanager URL. |
+| Option | Description |
+| ------ | ---------------------------------------------------------------------------------------------------------------------------------- |
+| URL | The Alertmanager URL. This field is [protected](ref:configure-contact-points#protected-fields) from modification in Grafana Cloud. |
#### Optional settings
diff --git a/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-jira.md b/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-jira.md
index 4d4ec4b3200..4a04153a593 100644
--- a/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-jira.md
+++ b/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-jira.md
@@ -49,14 +49,14 @@ For more details on contact points, including how to test them and enable notifi
### Required Settings
-| Key | Description |
-| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| URL | The URL of the REST API of your Jira instance. Supported versions: `2` and `3` (e.g., `https://your-domain.atlassian.net/rest/api/3`). |
-| Basic Auth User | Username for authentication. For Jira Cloud, use your email address. |
-| Basic Auth Password | Password or personal token. For Jira Cloud, you need to obtain a personal token [here](https://id.atlassian.com/manage-profile/security/api-tokens) and use it as the password. |
-| API Token | An alternative to basic authentication, a bearer token is used to authorize the API requests. See [Jira documentation](https://confluence.atlassian.com/enterprise/using-personal-access-tokens-1026032365.html) for more information. |
-| Project Key | The project key identifying the project where issues will be created. Project keys are unique identifiers for a project. |
-| Issue Type | The type of issue to create (e.g., `Task`, `Bug`, `Incident`). Make sure that you specify a type that is available in your project. |
+| Key | Description |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| URL | The URL of the REST API of your Jira instance. Supported versions: `2` and `3` (e.g., `https://your-domain.atlassian.net/rest/api/3`). This field is [protected](ref:configure-contact-points#protected-fields) from modification in Grafana Cloud. |
+| Basic Auth User | Username for authentication. For Jira Cloud, use your email address. |
+| Basic Auth Password | Password or personal token. For Jira Cloud, you need to obtain a personal token [here](https://id.atlassian.com/manage-profile/security/api-tokens) and use it as the password. |
+| API Token | An alternative to basic authentication, a bearer token is used to authorize the API requests. See [Jira documentation](https://confluence.atlassian.com/enterprise/using-personal-access-tokens-1026032365.html) for more information. |
+| Project Key | The project key identifying the project where issues will be created. Project keys are unique identifiers for a project. |
+| Issue Type | The type of issue to create (e.g., `Task`, `Bug`, `Incident`). Make sure that you specify a type that is available in your project. |
### Optional Settings
diff --git a/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-mqtt.md b/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-mqtt.md
index 8e58e619f00..6f76a574619 100644
--- a/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-mqtt.md
+++ b/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/configure-mqtt.md
@@ -54,10 +54,10 @@ For more details on contact points, including how to test them and enable notifi
### Required Settings
-| Option | Description |
-| ---------- | -------------------------------------------- |
-| Broker URL | The URL of the MQTT broker. |
-| Topic | The topic to which the message will be sent. |
+| Option | Description |
+| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| Broker URL | The URL of the MQTT broker. This field is [protected](ref:configure-contact-points#protected-fields) from modification in Grafana Cloud. |
+| Topic | The topic to which the message will be sent. |
### Optional Settings
diff --git a/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/webhook-notifier.md b/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/webhook-notifier.md
index 2829b14e235..7eb6394fbc8 100644
--- a/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/webhook-notifier.md
+++ b/docs/sources/alerting/configure-notifications/manage-contact-points/integrations/webhook-notifier.md
@@ -62,9 +62,9 @@ For more details on contact points, including how to test them and enable notifi
## Webhook settings
-| Option | Description |
-| ------ | ---------------- |
-| URL | The Webhook URL. |
+| Option | Description |
+| ------ | ----------------------------------------------------------------------------------------------------------------------------- |
+| URL | The Webhook URL. This field is [protected](ref:configure-contact-points#protected-fields) from modification in Grafana Cloud. |
#### Optional settings