An audit needs to determine who changed a security-platform configuration. Which approach best fits?

1. Configure supported workforce federation and explicit authorization.
2. Review supported platform and Cloud Audit Logs administrative evidence.
3. Use a dedicated least-privilege workload identity for the integration.
4. Grant narrowly scoped security-platform roles matching their duties.