Examples:

• "example.ac.at", should use the same "canonical" DNS domain as the "scope" part of eduPersonPrincipalName and eduPersonScopedAffiliation.
• Could be used as an identifier for the institution which is independent from the IDP's entityID (e.g. for mapping of institutional contracts)
• Could be used to only send the "scope" part of eduPersonScopedAffiliation when the "affiliation" is not needed at the Service Provider, but note the warning below!
• TCS Personal Certs