External workforce analysts should authenticate through an approved organizational identity provider. Which approach best fits?

1. Grant narrowly scoped security-platform roles matching their duties.
2. Use a dedicated least-privilege workload identity for the integration.
3. Review supported platform and Cloud Audit Logs administrative evidence.
4. Configure supported workforce federation and explicit authorization.