diff --git a/app/assets/javascripts/token_access/components/inbound_token_access.vue b/app/assets/javascripts/token_access/components/inbound_token_access.vue
index b927483ade5c1f6df51e7e1444dca95eb5f9cf9c..82d3be7b9f2f72768881dc025942bdaffdbf6df0 100644
--- a/app/assets/javascripts/token_access/components/inbound_token_access.vue
+++ b/app/assets/javascripts/token_access/components/inbound_token_access.vue
@@ -132,6 +132,13 @@ export default {
         } else {
           projects = project?.ciJobTokenScope?.inboundAllowlist?.nodes ?? [];
           groups = project?.ciJobTokenScope?.groupsAllowlist?.nodes ?? [];
+          const groupAllowlistAutopopulatedIds =
+            project?.ciJobTokenScope?.groupAllowlistAutopopulatedIds ?? [];
+          const inboundAllowlistAutopopulatedIds =
+            project?.ciJobTokenScope?.inboundAllowlistAutopopulatedIds ?? [];
+
+          projects = this.addAutopopulatedAttribute(projects, inboundAllowlistAutopopulatedIds);
+          groups = this.addAutopopulatedAttribute(groups, groupAllowlistAutopopulatedIds);
         }
 
         return { projects, groups };
@@ -201,6 +208,7 @@ export default {
         ...node.target,
         defaultPermissions: node.defaultPermissions,
         jobTokenPolicies: node.jobTokenPolicies,
+        autopopulated: node.autopopulated,
       }));
     },
     async updateCIJobTokenScope() {
@@ -269,6 +277,12 @@ export default {
       this.namespaceToEdit = namespace;
       showFormFn();
     },
+    addAutopopulatedAttribute(collection, idList) {
+      return collection.map((item) => ({
+        ...item,
+        autopopulated: idList.includes(item.id),
+      }));
+    },
   },
 };
 </script>
diff --git a/app/assets/javascripts/token_access/components/token_access_table.vue b/app/assets/javascripts/token_access/components/token_access_table.vue
index c7d1e0bb91978f234405bd1e8e00473995b0291b..d145aaac1430ef696ef794324894d6e0d618bba4 100644
--- a/app/assets/javascripts/token_access/components/token_access_table.vue
+++ b/app/assets/javascripts/token_access/components/token_access_table.vue
@@ -1,5 +1,13 @@
 <script>
-import { GlButton, GlIcon, GlLink, GlTable, GlLoadingIcon, GlSprintf } from '@gitlab/ui';
+import {
+  GlButton,
+  GlIcon,
+  GlLink,
+  GlTable,
+  GlLoadingIcon,
+  GlSprintf,
+  GlTooltipDirective,
+} from '@gitlab/ui';
 import { TYPENAME_GROUP } from '~/graphql_shared/constants';
 import ProjectAvatar from '~/vue_shared/components/project_avatar.vue';
 import { s__, __ } from '~/locale';
@@ -15,6 +23,12 @@ export default {
     GlSprintf,
     ProjectAvatar,
   },
+  directives: {
+    GlTooltip: GlTooltipDirective,
+  },
+  i18n: {
+    autopopulated: s__('CICD|Added from log.'),
+  },
   inject: ['fullPath'],
   props: {
     items: {
@@ -101,6 +115,15 @@ export default {
         <gl-link :href="item.webUrl" data-testid="token-access-name">
           {{ item.fullPath }}
         </gl-link>
+        <gl-icon
+          v-if="item.autopopulated"
+          v-gl-tooltip
+          :title="$options.i18n.autopopulated"
+          :aria-label="$options.i18n.autopopulated"
+          name="log"
+          class="gl-ml-3 gl-shrink-0"
+          data-testid="autopopulated-icon"
+        />
       </div>
     </template>
 
diff --git a/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql b/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
index cb2c7cb17405a9c82b026be8997736f887032de8..916561d81eb1770bc43626482a8d6b1a6872dd4d 100644
--- a/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
+++ b/app/assets/javascripts/token_access/graphql/fragments/allowlist_entry.fragment.graphql
@@ -1,6 +1,7 @@
 fragment AllowlistEntry on CiJobTokenScopeAllowlistEntry {
   defaultPermissions
   jobTokenPolicies
+  autopopulated
   target {
     ... on Group {
       id
diff --git a/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql b/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
index bd35648453efb617d8a278ab11e8fc1c22b1d7c1..c8651523e5217a044649e27ff78a63ab765bc795 100644
--- a/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
+++ b/app/assets/javascripts/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql
@@ -20,6 +20,8 @@ query inboundGetGroupsAndProjectsWithCIJobTokenScope($fullPath: ID!) {
           webUrl
         }
       }
+      groupAllowlistAutopopulatedIds
+      inboundAllowlistAutopopulatedIds
     }
   }
 }
diff --git a/app/graphql/types/ci/job_token_scope/allowlist_entry_type.rb b/app/graphql/types/ci/job_token_scope/allowlist_entry_type.rb
index d23b0ca2cec2a67f6094ead0992022b30ff5d6c9..aa83e8c5b4357e9972dc31a4020ac02625bd3552 100644
--- a/app/graphql/types/ci/job_token_scope/allowlist_entry_type.rb
+++ b/app/graphql/types/ci/job_token_scope/allowlist_entry_type.rb
@@ -46,6 +46,11 @@ class AllowlistEntryType < BaseObject
           null: false,
           description: 'When the entry was created.'
 
+        field :autopopulated,
+          GraphQL::Types::Boolean,
+          null: true,
+          description: 'Indicates whether the entry is created by the autopopulation process.'
+
         def source_project
           Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, object.source_project_id).find
         end
diff --git a/app/graphql/types/ci/job_token_scope_type.rb b/app/graphql/types/ci/job_token_scope_type.rb
index 7fc1feba2ece73db0288b39f44843bc121408287..2fed56ad739f649bef879109208b23f7924c5524 100644
--- a/app/graphql/types/ci/job_token_scope_type.rb
+++ b/app/graphql/types/ci/job_token_scope_type.rb
@@ -53,6 +53,20 @@ class JobTokenScopeType < BaseObject
           "by authenticating with a CI/CD job token. " \
           "The count does not include subgroups.",
         method: :groups_count
+
+      field :group_allowlist_autopopulated_ids,
+        [::Types::GlobalIDType[::Group]],
+        null: false,
+        description: 'List of IDs of groups which have been created by the  ' \
+          'autopopulation process.',
+        method: :autopopulated_group_ids
+
+      field :inbound_allowlist_autopopulated_ids,
+        [::Types::GlobalIDType[::Project]],
+        null: false,
+        description: 'List of IDs of projects which have been created by the  ' \
+          'autopopulation process.',
+        method: :autopopulated_inbound_project_ids
     end
   end
   # rubocop: enable Graphql/AuthorizeTypes
diff --git a/app/models/ci/job_token/allowlist.rb b/app/models/ci/job_token/allowlist.rb
index a34cf54f4e025df0b9315f0723d1e6d8e8132cff..1123ff4773bc3039bcc3f4a2c700732ca4b1b95b 100644
--- a/app/models/ci/job_token/allowlist.rb
+++ b/app/models/ci/job_token/allowlist.rb
@@ -69,6 +69,14 @@ def group_link_traversal_ids
         group_links.includes(:target_group).map { |g| g.target_group.traversal_ids }
       end
 
+      def autopopulated_project_global_ids
+        project_links.autopopulated.map { |link| link.target_project.to_global_id }.uniq
+      end
+
+      def autopopulated_group_global_ids
+        group_links.autopopulated.map { |link| link.target_group.to_global_id }.uniq
+      end
+
       def project_links
         Ci::JobToken::ProjectScopeLink
           .with_source(@source_project)
diff --git a/app/models/ci/job_token/scope.rb b/app/models/ci/job_token/scope.rb
index fcd6f0f68733b690e06b6fc8d38545fc05f1a20f..df71fc39ebc179bf11b0fb654c9dc9bbccf1a7e7 100644
--- a/app/models/ci/job_token/scope.rb
+++ b/app/models/ci/job_token/scope.rb
@@ -62,6 +62,14 @@ def groups_count
         groups.count
       end
 
+      def autopopulated_group_ids
+        inbound_allowlist.autopopulated_group_global_ids
+      end
+
+      def autopopulated_inbound_project_ids
+        inbound_allowlist.autopopulated_project_global_ids
+      end
+
       def self_referential?(accessed_project)
         current_project.id == accessed_project.id
       end
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 58866fcac9aadaa72ccd3180aab4b5bf24beb947..930f9f1a906602e2454af1b54c55692a21b84445 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -21110,6 +21110,7 @@ Represents an allowlist entry for the CI_JOB_TOKEN.
 | Name | Type | Description |
 | ---- | ---- | ----------- |
 | <a id="cijobtokenscopeallowlistentryaddedby"></a>`addedBy` | [`UserCore`](#usercore) | User that added the entry. |
+| <a id="cijobtokenscopeallowlistentryautopopulated"></a>`autopopulated` | [`Boolean`](#boolean) | Indicates whether the entry is created by the autopopulation process. |
 | <a id="cijobtokenscopeallowlistentrycreatedat"></a>`createdAt` | [`Time!`](#time) | When the entry was created. |
 | <a id="cijobtokenscopeallowlistentrydefaultpermissions"></a>`defaultPermissions` | [`Boolean`](#boolean) | Indicates whether default permissions are enabled (true) or fine-grained permissions are enabled (false). |
 | <a id="cijobtokenscopeallowlistentrydirection"></a>`direction` | [`String`](#string) | Direction of access. Defaults to INBOUND. |
@@ -21123,9 +21124,11 @@ Represents an allowlist entry for the CI_JOB_TOKEN.
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
+| <a id="cijobtokenscopetypegroupallowlistautopopulatedids"></a>`groupAllowlistAutopopulatedIds` | [`[GroupID!]!`](#groupid) | List of IDs of groups which have been created by the autopopulation process. |
 | <a id="cijobtokenscopetypegroupsallowlist"></a>`groupsAllowlist` | [`GroupConnection!`](#groupconnection) | Allowlist of groups that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
 | <a id="cijobtokenscopetypegroupsallowlistcount"></a>`groupsAllowlistCount` | [`Int!`](#int) | Count of groups that can access the current project by authenticating with a CI/CD job token. The count does not include subgroups. |
 | <a id="cijobtokenscopetypeinboundallowlist"></a>`inboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allowlist of projects that can access the current project by authenticating with a CI/CD job token. (see [Connections](#connections)) |
+| <a id="cijobtokenscopetypeinboundallowlistautopopulatedids"></a>`inboundAllowlistAutopopulatedIds` | [`[ProjectID!]!`](#projectid) | List of IDs of projects which have been created by the autopopulation process. |
 | <a id="cijobtokenscopetypeinboundallowlistcount"></a>`inboundAllowlistCount` | [`Int!`](#int) | Count of projects that can access the current project by authenticating with a CI/CD job token. The count does not include nested projects. |
 | <a id="cijobtokenscopetypeoutboundallowlist"></a>`outboundAllowlist` | [`ProjectConnection!`](#projectconnection) | Allow list of projects that are accessible using the current project's CI Job tokens. (see [Connections](#connections)) |
 | <a id="cijobtokenscopetypeprojects"></a>`projects` **{warning-solid}** | [`ProjectConnection!`](#projectconnection) | **Deprecated** in GitLab 15.9. The `projects` attribute is being deprecated. Use `outbound_allowlist`. |
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 14f7c5df97fbb41386ed3561e8a136cc2b81e333..a73c737d8cbea9bc7bd3b03981d969874589b2f7 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -11033,6 +11033,9 @@ msgstr ""
 msgid "CICD|Add an existing project to the scope"
 msgstr ""
 
+msgid "CICD|Added from log."
+msgstr ""
+
 msgid "CICD|Additional permissions"
 msgstr ""
 
diff --git a/spec/frontend/token_access/mock_data.js b/spec/frontend/token_access/mock_data.js
index 57679d11195a6d483ad245b4a0dfc708e50a7244..8cb2e1f79f28d0a0fe9d23bf67414ea6210aefe4 100644
--- a/spec/frontend/token_access/mock_data.js
+++ b/spec/frontend/token_access/mock_data.js
@@ -78,6 +78,7 @@ export const mockGroups = [
     webUrl: 'http://localhost/some-group',
     defaultPermissions: false,
     jobTokenPolicies: ['READ_JOBS', 'ADMIN_CONTAINERS'],
+    autopopulated: true,
     __typename: 'Group',
   },
   {
@@ -87,6 +88,7 @@ export const mockGroups = [
     webUrl: 'http://localhost/another-group',
     defaultPermissions: true,
     jobTokenPolicies: [],
+    autopopulated: true,
     __typename: 'Group',
   },
   {
@@ -96,6 +98,7 @@ export const mockGroups = [
     webUrl: 'http://localhost/a-sub-group',
     defaultPermissions: false,
     jobTokenPolicies: [],
+    autopopulated: false,
     __typename: 'Group',
   },
 ];
@@ -113,6 +116,7 @@ export const mockProjects = [
     defaultPermissions: false,
     jobTokenPolicies: ['READ_JOBS'],
     isLocked: false,
+    autopopulated: true,
     __typename: 'Project',
   },
   {
@@ -127,6 +131,7 @@ export const mockProjects = [
     defaultPermissions: true,
     jobTokenPolicies: [],
     isLocked: true,
+    autopopulated: false,
     __typename: 'Project',
   },
 ];
@@ -192,6 +197,8 @@ export const inboundGroupsAndProjectsWithScopeResponse = {
             },
           ],
         },
+        groupAllowlistAutopopulatedIds: ['gid://gitlab/Group/45'],
+        inboundAllowlistAutopopulatedIds: ['gid://gitlab/Project/23'],
       },
     },
   },
diff --git a/spec/frontend/token_access/token_access_table_spec.js b/spec/frontend/token_access/token_access_table_spec.js
index 682c14f912ed137914d9d6631dbc12a3716796d9..9278d05c7d15e66a819f702d8e8cc3e178b809f7 100644
--- a/spec/frontend/token_access/token_access_table_spec.js
+++ b/spec/frontend/token_access/token_access_table_spec.js
@@ -21,6 +21,7 @@ describe('Token access table', () => {
   const findProjectAvatar = () => wrapper.findByTestId('token-access-avatar');
   const findName = () => wrapper.findByTestId('token-access-name');
   const findPolicies = () => findAllTableRows().at(0).findAll('td').at(1);
+  const findAutopopulatedIcon = () => wrapper.findByTestId('autopopulated-icon');
 
   describe.each`
     type         | items
@@ -124,4 +125,32 @@ describe('Token access table', () => {
       expect(findEditButton().exists()).toBe(false);
     });
   });
+
+  describe('group auto-populated icon', () => {
+    it('shows the icon when the item is auto-populated', () => {
+      createComponent({ items: [mockGroups[0]] });
+
+      expect(findAutopopulatedIcon().exists()).toBe(true);
+    });
+
+    it('does no shows the icon when the item is not auto-populated', () => {
+      createComponent({ items: [mockGroups[2]] });
+
+      expect(findAutopopulatedIcon().exists()).toBe(false);
+    });
+  });
+
+  describe('project auto-populated icon', () => {
+    it('shows the icon when the item is auto-populated', () => {
+      createComponent({ items: [mockProjects[0]] });
+
+      expect(findAutopopulatedIcon().exists()).toBe(true);
+    });
+
+    it('does no shows the icon when the item is not auto-populated', () => {
+      createComponent({ items: [mockProjects[1]] });
+
+      expect(findAutopopulatedIcon().exists()).toBe(false);
+    });
+  });
 });
diff --git a/spec/graphql/types/ci/job_token_scope/allowlist_entry_type_spec.rb b/spec/graphql/types/ci/job_token_scope/allowlist_entry_type_spec.rb
index 58dd4cd18b2690b8fbd776ec00b45521c05d8a8f..7e3b4896f335f588a77f4039808f1c30e9d4264d 100644
--- a/spec/graphql/types/ci/job_token_scope/allowlist_entry_type_spec.rb
+++ b/spec/graphql/types/ci/job_token_scope/allowlist_entry_type_spec.rb
@@ -14,6 +14,7 @@
       job_token_policies
       added_by
       created_at
+      autopopulated
     ]
 
     expect(described_class).to have_graphql_fields(*expected_fields)
diff --git a/spec/graphql/types/ci/job_token_scope_type_spec.rb b/spec/graphql/types/ci/job_token_scope_type_spec.rb
index 1445d17276bb816a34844bae99349e72d13461f7..0034aa57bf6101c49063be96a80a31ac0203893c 100644
--- a/spec/graphql/types/ci/job_token_scope_type_spec.rb
+++ b/spec/graphql/types/ci/job_token_scope_type_spec.rb
@@ -7,7 +7,8 @@
 
   it 'has the correct fields' do
     expected_fields = [:projects, :inboundAllowlist, :outboundAllowlist,
-      :groupsAllowlist, :inboundAllowlistCount, :groupsAllowlistCount]
+      :groupsAllowlist, :inboundAllowlistCount, :groupsAllowlistCount,
+      :groupAllowlistAutopopulatedIds, :inboundAllowlistAutopopulatedIds]
 
     expect(described_class).to have_graphql_fields(*expected_fields)
   end
diff --git a/spec/models/ci/job_token/allowlist_spec.rb b/spec/models/ci/job_token/allowlist_spec.rb
index b08b292b1cb0562f157d673a123470bc019c3e47..7f120806bb0f1b43b9a7824ad7acf4a31da67b4d 100644
--- a/spec/models/ci/job_token/allowlist_spec.rb
+++ b/spec/models/ci/job_token/allowlist_spec.rb
@@ -392,4 +392,48 @@
       end
     end
   end
+
+  describe '#autopopulated_project_global_ids' do
+    let!(:project_link1) do
+      create(:ci_job_token_project_scope_link, source_project: source_project, autopopulated: true)
+    end
+
+    let!(:project_link2) do
+      create(:ci_job_token_project_scope_link, source_project: source_project, autopopulated: true)
+    end
+
+    let!(:project_link3) do
+      create(:ci_job_token_project_scope_link, source_project: source_project)
+    end
+
+    it 'returns an array of autopopulated project global ids only' do
+      project_global_ids = allowlist.autopopulated_project_global_ids
+
+      expect(project_global_ids.size).to eq 2
+      expect(project_global_ids).to contain_exactly(project_link1.target_project.to_global_id,
+        project_link2.target_project.to_global_id)
+    end
+  end
+
+  describe '#autopopulated_group_global_ids' do
+    let!(:group_link1) do
+      create(:ci_job_token_group_scope_link, source_project: source_project, autopopulated: true)
+    end
+
+    let!(:group_link2) do
+      create(:ci_job_token_group_scope_link, source_project: source_project, autopopulated: true)
+    end
+
+    let!(:group_link3) do
+      create(:ci_job_token_group_scope_link, source_project: source_project)
+    end
+
+    it 'returns an array of autopopulated group global ids only' do
+      group_global_ids = allowlist.autopopulated_group_global_ids
+
+      expect(group_global_ids.size).to eq 2
+      expect(group_global_ids).to contain_exactly(group_link1.target_group.to_global_id,
+        group_link2.target_group.to_global_id)
+    end
+  end
 end
diff --git a/spec/requests/api/graphql/packages/package_spec.rb b/spec/requests/api/graphql/packages/package_spec.rb
index 4054d848b0dba879b5505c2eea0d19335694a37e..511a4008dfe8d04fb70806b14370bf739a807d24 100644
--- a/spec/requests/api/graphql/packages/package_spec.rb
+++ b/spec/requests/api/graphql/packages/package_spec.rb
@@ -18,7 +18,8 @@
   let(:depth) { 3 }
   let(:excluded) do
     %w[metadata apiFuzzingCiConfiguration pipeline packageFiles
-      runners inboundAllowlistCount groupsAllowlistCount mergeTrains ciJobTokenAuthLogs]
+      runners inboundAllowlistCount groupsAllowlistCount mergeTrains ciJobTokenAuthLogs
+      groupAllowlistAutopopulatedIds inboundAllowlistAutopopulatedIds]
   end
 
   let(:metadata) { query_graphql_fragment('ComposerMetadata') }
diff --git a/spec/requests/api/graphql/project/merge_request_spec.rb b/spec/requests/api/graphql/project/merge_request_spec.rb
index 6f9b3068af25c7e7af59d6c835b2667a9d95e207..19a0b80b9be35badfc7d006369d7d27e43931f4a 100644
--- a/spec/requests/api/graphql/project/merge_request_spec.rb
+++ b/spec/requests/api/graphql/project/merge_request_spec.rb
@@ -24,11 +24,13 @@
     # we exclude Project.pipeline because it needs arguments,
     # codequalityReportsComparer because it is behind a feature flag
     # and runners because the user is not an admin and therefore has no access
-    # and inboundAllowlistCount, groupsAllowlistCount the user has no access
+    # and inboundAllowlistCount, groupsAllowlistCount, groupAllowlistAutopopulatedIds,
+    #   inboundAllowlistAutopopulatedIds the user has no access
     # mergeTrains because it is a licensed feature
     let(:excluded) do
       %w[jobs pipeline runners codequalityReportsComparer
-        mlModels inboundAllowlistCount groupsAllowlistCount mergeTrains ciJobTokenAuthLogs mlExperiments]
+        mlModels inboundAllowlistCount groupsAllowlistCount mergeTrains ciJobTokenAuthLogs mlExperiments
+        groupAllowlistAutopopulatedIds inboundAllowlistAutopopulatedIds]
     end
 
     let(:mr_fields) { all_graphql_fields_for('MergeRequest', excluded: excluded) }