3791332 - Issue with Policy-Based Authorization for Password Reset

An authorization policy has been established to permit specific users to set initial passwords for others. The policy configuration is as follows or similar:

POLICY "test-policy" {
    USE users.UPDATE_USERS
        RESTRICT
            user.attributes IN ('password', 'active', 'urn:ietf:params:scim:schemas:extension:sap:2.0:User:status')
    ;
    USE users.READ_USERS;
}

or:

POLICY "test-policy" {
    USE users.UPDATE_USERS;
    USE users.READ_USERS;
}

Despite this setup, users assigned to this policy are experiencing issues when attempting to reset initial password for user.  They are either encountering an error message, "You are not authorized for this action" or being redirected to an "Access Denied" page. 

SAP Cloud Identity Services

KBA , BC-IAM-IDS , Identity Authentication Service , Problem