diff --git a/docs/pages/upgrading/automatic-agent-updates.mdx b/docs/pages/upgrading/automatic-agent-updates.mdx
index b466572de30a4..ba6eb626da644 100644
--- a/docs/pages/upgrading/automatic-agent-updates.mdx
+++ b/docs/pages/upgrading/automatic-agent-updates.mdx
@@ -150,10 +150,6 @@ Server ID                            Hostname      Services Version Upgrader
 ...
 ```
 
-Note that the `inventory ls` command will also list `teleport-auth` and
-`teleport-proxy` services. If you use managed Teleport Enterprise, the Teleport
-team updates these services automatically.
-
 ## Step 3/4. Enroll agents on Linux servers in automatic updates
 
 1. For each agent ID returned by the `tctl inventory ls` command, copy the ID
diff --git a/docs/pages/upgrading/reference.mdx b/docs/pages/upgrading/reference.mdx
index 8992492c2506c..045577ce46476 100644
--- a/docs/pages/upgrading/reference.mdx
+++ b/docs/pages/upgrading/reference.mdx
@@ -278,10 +278,6 @@ self-hosted clusters, as well as all Teleport agents.
    ...
    ```
 
-   Note that the `inventory ls` command will also list `teleport-auth` and
-   `teleport-proxy` services. These services are managed by the Teleport team, and
-   updates will be performed automatically.
-
 1. For each agent ID returned by the `tctl inventory ls` command, copy the ID
    and run the following `tctl` command to access the host via `tsh`:
 
diff --git a/tool/tctl/common/inventory_command.go b/tool/tctl/common/inventory_command.go
index d17ddf296b4f3..bac450d83c5e9 100644
--- a/tool/tctl/common/inventory_command.go
+++ b/tool/tctl/common/inventory_command.go
@@ -177,12 +177,20 @@ func printHierarchicalData(data map[string]any, indent string, depth int) {
 func (c *InventoryCommand) List(ctx context.Context, client *authclient.Client) error {
 	var services []types.SystemRole
 	var err error
+	var omitControlPlane bool
 	if c.services != "" {
 		services, err = types.ParseTeleportRoles(c.services)
 		if err != nil {
 			return trace.Wrap(err)
 		}
+	} else {
+		resp, err := client.Ping(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		omitControlPlane = resp.GetServerFeatures().GetCloud()
 	}
+
 	upgrader := c.upgrader
 	var noUpgrader bool
 	if upgrader == "none" {
@@ -205,6 +213,13 @@ func (c *InventoryCommand) List(ctx context.Context, client *authclient.Client)
 		table := asciitable.MakeTable([]string{"Server ID", "Hostname", "Services", "Agent Version", "Upgrader", "Upgrader Version"})
 		for instances.Next() {
 			instance := instances.Item()
+
+			// The auth and proxy services should be omitted from the inventory list
+			// on Managed Teleport Enterprise (Cloud-Hosted) instances.
+			if omitControlPlane && (instance.HasService(types.RoleAuth) || instance.HasService(types.RoleProxy)) {
+				continue
+			}
+
 			services := make([]string, 0, len(instance.GetServices()))
 			for _, s := range instance.GetServices() {
 				services = append(services, string(s))