In case the user authentication is outsourced for a company, does it need to be included in the scope? I think that even if it is outsourced it must be included in the scope definition.
It may not have to be included in the scope definition. However, it would be difficult to have information security management system (ISMS) without user authentication (see section A.9 on access control). The boundaries of the ISMS (scope) need to be established after considering the needs and expectations of the interested parties.