A department needs a different service policy inherited by its members while remaining in the organization's hierarchy. Which approach best fits?

1. Use a suitable group and the setting's supported group-based controls.
2. Configure supported SAML SSO and test the identity mapping.
3. Place relevant users in an appropriate organizational unit and configure its policy.
4. Use an appropriate directory synchronization or automated provisioning tool.