Only a designated employee group should access an additional Google service supported by administrative controls. Which approach best fits?

1. Use the security center's applicable health and investigation capabilities.
2. Review relevant login and security audit events.
3. Apply the service's supported group or organizational-unit access policy.
4. Configure the SAML application, user assignment, and identity mapping.