A company manages employee identities in a directory and needs repeatable supported synchronization into Google Workspace. Which approach best fits?

1. Use a suitable group and the setting's supported group-based controls.
2. Place relevant users in an appropriate organizational unit and configure its policy.
3. Configure supported SAML SSO and test the identity mapping.
4. Use an appropriate directory synchronization or automated provisioning tool.