This article explains why the ssf.manage and ssf.read scopes might be missing in the Okta API Scopes list for an OpenID Connect (OIDC) app:

• Okta Identity Engine (OIE)
• OpenID Connect (OIDC)
• Apple Business

If the ssf.manage and ssf.read scopes in the Okta API Scopes list are missing from a Workforce Org, then it is missing the Lifecycle Management SKU or is not on the Okta Identity Engine. Interested parties should contact the account team to add this feature.

Related References 

• Integration with Okta and Apple Business
• Okta Shared Signals Framework for Integration with Apple Business and Essentials
• Configure Okta Business Manager
• External Blog: Okta Integration with Apple Business and Apple School Manager