diff --git a/.changelog/3399.txt b/.changelog/3399.txt
new file mode 100644
index 0000000000..24d81204c2
--- /dev/null
+++ b/.changelog/3399.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/tencentcloud_mqtt_instance: support `authorization_policy`
+```
diff --git a/tencentcloud/services/mqtt/resource_tc_mqtt_instance.go b/tencentcloud/services/mqtt/resource_tc_mqtt_instance.go
index ce872e528e..9d628b2ec8 100644
--- a/tencentcloud/services/mqtt/resource_tc_mqtt_instance.go
+++ b/tencentcloud/services/mqtt/resource_tc_mqtt_instance.go
@@ -76,6 +76,7 @@ func ResourceTencentCloudMqttInstance() *schema.Resource {
 			"renew_flag": {
 				Type:        schema.TypeInt,
 				Optional:    true,
+				Computed:    true,
 				Description: "Whether to enable auto-renewal (0: Disabled; 1: Enabled).",
 			},
 
@@ -105,6 +106,13 @@ func ResourceTencentCloudMqttInstance() *schema.Resource {
 				Description: "Is the automatic registration certificate automatically activated. Default is false.",
 			},
 
+			"authorization_policy": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Computed:    true,
+				Description: "Authorization policy switch. Default is false.",
+			},
+
 			"force_delete": {
 				Type:        schema.TypeBool,
 				Optional:    true,
@@ -226,27 +234,39 @@ func ResourceTencentCloudMqttInstanceCreate(d *schema.ResourceData, meta interfa
 		return reqErr
 	}
 
-	// open automatic_activation
+	var (
+		isAutomaticActivation bool
+		isAuthorizationPolicy bool
+	)
+
 	if v, ok := d.GetOkExists("automatic_activation"); ok {
-		if v.(bool) {
-			modifyRequest := mqttv20240516.NewModifyInstanceRequest()
-			modifyRequest.InstanceId = &instanceId
-			modifyRequest.AutomaticActivation = helper.Bool(v.(bool))
-			reqErr := resource.Retry(tccommon.WriteRetryTimeout, func() *resource.RetryError {
-				result, e := meta.(tccommon.ProviderMeta).GetAPIV3Conn().UseMqttV20240516Client().ModifyInstanceWithContext(ctx, modifyRequest)
-				if e != nil {
-					return tccommon.RetryError(e)
-				} else {
-					log.Printf("[DEBUG]%s api[%s] success, request body [%s], response body [%s]\n", logId, modifyRequest.GetAction(), modifyRequest.ToJsonString(), result.ToJsonString())
-				}
+		isAutomaticActivation = v.(bool)
+	}
 
-				return nil
-			})
+	if v, ok := d.GetOkExists("authorization_policy"); ok {
+		isAuthorizationPolicy = v.(bool)
+	}
 
-			if reqErr != nil {
-				log.Printf("[CRITAL]%s update mqtt failed, reason:%+v", logId, reqErr)
-				return reqErr
+	// open automatic_activation or authorization_policy
+	if isAutomaticActivation || isAuthorizationPolicy {
+		modifyRequest := mqttv20240516.NewModifyInstanceRequest()
+		modifyRequest.InstanceId = &instanceId
+		modifyRequest.AutomaticActivation = helper.Bool(isAutomaticActivation)
+		modifyRequest.AuthorizationPolicy = helper.Bool(isAuthorizationPolicy)
+		reqErr := resource.Retry(tccommon.WriteRetryTimeout, func() *resource.RetryError {
+			result, e := meta.(tccommon.ProviderMeta).GetAPIV3Conn().UseMqttV20240516Client().ModifyInstanceWithContext(ctx, modifyRequest)
+			if e != nil {
+				return tccommon.RetryError(e)
+			} else {
+				log.Printf("[DEBUG]%s api[%s] success, request body [%s], response body [%s]\n", logId, modifyRequest.GetAction(), modifyRequest.ToJsonString(), result.ToJsonString())
 			}
+
+			return nil
+		})
+
+		if reqErr != nil {
+			log.Printf("[CRITAL]%s update mqtt failed, reason:%+v", logId, reqErr)
+			return reqErr
 		}
 	}
 
@@ -322,6 +342,10 @@ func ResourceTencentCloudMqttInstanceRead(d *schema.ResourceData, meta interface
 		_ = d.Set("automatic_activation", respData.AutomaticActivation)
 	}
 
+	if respData.AuthorizationPolicy != nil {
+		_ = d.Set("authorization_policy", respData.AuthorizationPolicy)
+	}
+
 	forceDelete := false
 	if v, ok := d.GetOkExists("force_delete"); ok {
 		forceDelete = v.(bool)
@@ -356,7 +380,7 @@ func ResourceTencentCloudMqttInstanceUpdate(d *schema.ResourceData, meta interfa
 	}
 
 	needChange := false
-	mutableArgs := []string{"name", "remark", "sku_code", "device_certificate_provision_type", "automatic_activation"}
+	mutableArgs := []string{"name", "remark", "sku_code", "device_certificate_provision_type", "automatic_activation", "authorization_policy"}
 	for _, v := range mutableArgs {
 		if d.HasChange(v) {
 			needChange = true
@@ -383,6 +407,10 @@ func ResourceTencentCloudMqttInstanceUpdate(d *schema.ResourceData, meta interfa
 			request.AutomaticActivation = helper.Bool(v.(bool))
 		}
 
+		if v, ok := d.GetOkExists("authorization_policy"); ok {
+			request.AuthorizationPolicy = helper.Bool(v.(bool))
+		}
+
 		reqErr := resource.Retry(tccommon.WriteRetryTimeout, func() *resource.RetryError {
 			result, e := meta.(tccommon.ProviderMeta).GetAPIV3Conn().UseMqttV20240516Client().ModifyInstanceWithContext(ctx, request)
 			if e != nil {
diff --git a/tencentcloud/services/mqtt/resource_tc_mqtt_instance.md b/tencentcloud/services/mqtt/resource_tc_mqtt_instance.md
index ea9010caa5..d2949c2c00 100644
--- a/tencentcloud/services/mqtt/resource_tc_mqtt_instance.md
+++ b/tencentcloud/services/mqtt/resource_tc_mqtt_instance.md
@@ -78,6 +78,7 @@ resource "tencentcloud_mqtt_instance" "example" {
   renew_flag           = 1
   force_delete         = false
   automatic_activation = true
+  authorization_policy = true
   tags = {
     createBy = "Terraform"
   }
diff --git a/website/docs/r/mqtt_instance.html.markdown b/website/docs/r/mqtt_instance.html.markdown
index 1123ea5571..bfd3e257d6 100644
--- a/website/docs/r/mqtt_instance.html.markdown
+++ b/website/docs/r/mqtt_instance.html.markdown
@@ -89,6 +89,7 @@ resource "tencentcloud_mqtt_instance" "example" {
   renew_flag           = 1
   force_delete         = false
   automatic_activation = true
+  authorization_policy = true
   tags = {
     createBy = "Terraform"
   }
@@ -102,6 +103,7 @@ The following arguments are supported:
 * `instance_type` - (Required, String) Instance type. PRO for Professional Edition; PLATINUM for Platinum Edition.
 * `name` - (Required, String) Instance name.
 * `sku_code` - (Required, String) Product SKU, available SKUs can be queried via the DescribeProductSKUList API.
+* `authorization_policy` - (Optional, Bool) Authorization policy switch. Default is false.
 * `automatic_activation` - (Optional, Bool) Is the automatic registration certificate automatically activated. Default is false.
 * `force_delete` - (Optional, Bool) Indicate whether to force delete the instance. Default is `false`. If set true, the instance will be permanently deleted instead of being moved into the recycle bin. Note: only works for `PREPAID` instance.
 * `pay_mode` - (Optional, Int) Payment mode (0: Postpaid; 1: Prepaid).