diff --git a/hbase-common/src/main/resources/hbase-default.xml b/hbase-common/src/main/resources/hbase-default.xml
index 1bf63b136e04..2c036ae890bc 100644
--- a/hbase-common/src/main/resources/hbase-default.xml
+++ b/hbase-common/src/main/resources/hbase-default.xml
@@ -1201,7 +1201,8 @@ possible configurations would overwhelm and obscure the important.
     <value></value>
     <description>List of users or groups (comma-separated), who are allowed
     full privileges, regardless of stored ACLs, across the cluster.
-    Only used when HBase security is enabled.</description>
+    Only used when HBase security is enabled.
+    Group names should be prefixed with "@".</description>
   </property>
   <property>
     <name>hbase.auth.key.update.interval</name>
diff --git a/src/main/asciidoc/_chapters/hbase-default.adoc b/src/main/asciidoc/_chapters/hbase-default.adoc
index 03391cc38b1a..ccbaaabf694a 100644
--- a/src/main/asciidoc/_chapters/hbase-default.adoc
+++ b/src/main/asciidoc/_chapters/hbase-default.adoc
@@ -1417,6 +1417,7 @@ The policy configuration file used by RPC servers to make
 List of users or groups (comma-separated), who are allowed
     full privileges, regardless of stored ACLs, across the cluster.
     Only used when HBase security is enabled.
+    Group names should be prefixed with "@".
 +
 .Default
 ``
diff --git a/src/main/asciidoc/_chapters/security.adoc b/src/main/asciidoc/_chapters/security.adoc
index b2110a6fbcda..07cbfa7cb948 100644
--- a/src/main/asciidoc/_chapters/security.adoc
+++ b/src/main/asciidoc/_chapters/security.adoc
@@ -2259,7 +2259,7 @@ All options have been discussed separately in the sections above.
 <!-- HBase Superuser -->
 <property>
   <name>hbase.superuser</name>
-  <value>hbase,admin</value>
+  <value>hbase,admin,@superuser-group</value>
 </property>
 <!-- Coprocessors for ACLs and Visibility Tags -->
 <property>