Fix: Add crucial requirement for custom attributes in OIDC scope for access token inclusion (Product IS issue #27542)

en/includes/guides/fragments/manage-app/oidc-settings/access-token.md

@@ -55,13 +55,20 @@
     {% endif %}
 
 {% if product_name == "Asgardeo" or (product_name == "WSO2 Identity Server" and is_version != "7.0.0") %}
 #### Access Token Attributes
 
 For **JWT** access tokens, this feature enables you to specify which user attributes are included in the access token. As a result, when a user logs in to an application, only the chosen attributes are shared, providing enhanced security and flexibility.
 
 !!! note 
     All configured user attributes are included in the access token, regardless of the requested scopes.
 
+!!! warning
+    For custom attributes to appear in the access token, you must explicitly add them to an OIDC scope. Without this mapping, custom attributes will not be included in the access token, even if they are configured under **Access Token Attributes**.
+    For custom attributes to appear in the access token, you must explicitly add them to an OIDC scope. Without this mapping, custom attributes will not be included in the access token, even if they are configured under **Access Token Attributes**.
+
+    To map custom attributes to an OIDC scope, configure the scope settings in your application's OIDC configuration and ensure the custom attributes are associated with the appropriate scope.
+    To map custom attributes to an OIDC scope, [configure the custom attributes for the appropriate scopes]({{base_path}}/guides/users/attributes/manage-scopes/#edit-scopes) and ensure that your application's OIDC configuration is updated to request those scopes.
+
 ![Access-Token-Attributes]({{base_path}}/assets/img/guides/authorization/access-token/access-token-attributes.png){: width="600" style="display: block; margin: 0; border: 0.3px solid lightgrey;"}
 
 {% endif %}
@@ -130,8 +137,8 @@
 
     - **Revoke token upon user logout** - When enabled, a user logout from a session causes access tokens to be revoked provided the logout request contains either `client_id` or `id_token_hint`. Learn more about [logout requests]({{base_path}}/guides/authentication/oidc/add-logout/).
 
 #### User access token expiry time
 This option specifies the validity period of an access token issued to a user in seconds. The default expiry time is 3600 seconds.
 
 #### Application access token expiry time
 This option specifies the validity period of an access token issued to an application when using the `Client Credentials` grant type in seconds.