Accessing the SCIM api

Are you using basic auth, or client credentials (oauth)?

Have you tried removing the user from the workgroup, and just assigning those two capabilities directly?