Conclusion

In this tutorial, you set scope-based access to SCIM resources.

You also learned:

Like exclude-attributes used in this tutorial, include-attributes filters which attributes can be returned to the caller. include-attributes works more like opt-in, while exclude-attributes works more like opt-out.
Multiple attributes can apply from multiple rules or even policies. They are combined by PingAuthorize to include before exclude.