Users in different organizational units need a shared membership-based access or configuration scope where the setting supports it. Which approach best fits?

1. Use a suitable group and the setting's supported group-based controls.
2. Use an appropriate directory synchronization or automated provisioning tool.
3. Configure supported SAML SSO and test the identity mapping.
4. Place relevant users in an appropriate organizational unit and configure its policy.