diff --git a/components/device-mgt/org.wso2.carbon.device.mgt.api/src/main/java/org/wso2/carbon/device/mgt/jaxrs/service/impl/DeviceManagementServiceImpl.java b/components/device-mgt/org.wso2.carbon.device.mgt.api/src/main/java/org/wso2/carbon/device/mgt/jaxrs/service/impl/DeviceManagementServiceImpl.java
index 206ed55be9..6d0696df84 100644
--- a/components/device-mgt/org.wso2.carbon.device.mgt.api/src/main/java/org/wso2/carbon/device/mgt/jaxrs/service/impl/DeviceManagementServiceImpl.java
+++ b/components/device-mgt/org.wso2.carbon.device.mgt.api/src/main/java/org/wso2/carbon/device/mgt/jaxrs/service/impl/DeviceManagementServiceImpl.java
@@ -900,6 +900,7 @@ public class DeviceManagementServiceImpl implements DeviceManagementService {
         DeviceManagementProviderService deviceManagementProviderService =
                 DeviceMgtAPIUtils.getDeviceManagementService();
         int validityTime = 3600;
+        // add scopes for event topics
         List<String> mqttEventTopicStructure = new ArrayList<>();
         try {
             DeviceType deviceType = deviceManagementProviderService.getDeviceType(type);
@@ -940,10 +941,16 @@ public class DeviceManagementServiceImpl implements DeviceManagementService {
                     topic = topic.replace("${deviceId}", id);
                 }
                 topic = topic.replace("/",":");
-                scopes.append(" perm:topic:sub:".concat(topic));
+//                scopes.append(" perm:topic:sub:".concat(topic));
                 scopes.append(" perm:topic:pub:".concat(topic));
             }
 
+            // add scopes for retrieve operation topic /tenantDomain/deviceType/deviceId/operation/#
+            scopes.append(" perm:topic:sub:" + tenantDomain + ":" + type + ":" + id + ":operation");
+
+            // add scopes for update operation /tenantDomain/deviceType/deviceId/update/operation
+            scopes.append(" perm:topic:pub:" + tenantDomain + ":" + type + ":" + id + ":update:operation");
+
             TokenRequest tokenRequest = new TokenRequest(dcrResponse.getClientId(), dcrResponse.getClientSecret(),
                     null, scopes.toString(), "client_credentials", null,
                     null, null, null,  validityTime);