diff --git a/README.md b/README.md
index a7dcca9..aa3dc5e 100644
--- a/README.md
+++ b/README.md
@@ -275,13 +275,13 @@ Will be created if it does not exist.
 - Required: no
 - Template: yes
 
-Sharing profile to use for the gallery image. One of `community`, `groups`, `private`.
+Sharing profile to use for the gallery image. One of `community`, `private`. Sharing profile `groups` currently isn't supported.
 Community images are publicly available, group images are available to a specific group of users, private images are only available to the owner.
 
 ### `base.azure.sharingNamePrefix` / `variant.<name>.azure.sharingNamePrefix`
 
 - Default: none
-- Required: if `sharingProfile` is `community` or `groups`
+- Required: if `sharingProfile` is `community`
 - Template: yes
 
 Prefix for the shared image name. Example: `"myimage"`.
diff --git a/config/validation.rego b/config/validation.rego
index 288a7ae..35b52c7 100644
--- a/config/validation.rego
+++ b/config/validation.rego
@@ -196,7 +196,7 @@ deny[msg] {
 deny[msg] {
     input.Provider == "azure"
     input.Azure.SharingProfile != ""
-    allowed := ["community", "groups", "private"]
+    allowed := ["community", "private"]
     not input.Azure.SharingProfile in allowed
 
     msg = sprintf("sharing profile %q must be one of %s for provider azure", [input.Azure.SharingProfile, allowed])