Attribute access control

Some PingOne platform self-management scopes allow organizations to specify which user profile attributes are accessible to end users.

An administrator might want to prevent end users from seeing or modifying particular attributes that should remain private, such as custom attributes for entitlements, internal foreign keys, account status information, or any profile data that should not be exposed to an individual user. With access control scopes, organizations can store additional private data in the user profile without risk that the end user can see the data.

These access control scopes designate a specific set of user attributes, which is often a subset of attributes that the user is allowed to read or update. For example, a p1:update:user:email-only scope could remove all other user schema attributes except the user’s email address. A user with this scope could update only their email address. All other visible attributes would not allow modification.