[&] You are the user account administrator for INE shipping.  User accounts are managed in an on-premises Active Directory domain and synchronized with an Azure AD tenant. The Premium P1 license is active for the tenant. INE shipping has recently implemented their customer service management system in SalesForce, using Azure AD for authentication.  You need to limit access to the SalesForce application so that only users with one of five sales-related job titles can access it.  What is the easiest way to meet this requirement?
- Create a conditional access policy.  Apply the policy to all users.  Select SalesForce under Cloud Applications.  Set the filter to allow users who have any of the five job titles.
- Create an Azure AD security group that uses dynamic user membership.  Add a membership filter than includes all five job titles.  Grant this group access to the SalesForce application in Azure AD -- Correct
- Create an Active Directory security group.  Add users with any of the five job titles to the group.  Update HR processes to notify you whenever someone changes their job title or a new hire has one of the five job titles.  Grant this group access to the SalesForce application in Azure AD.
- Create an Azure security group with assigned membership.  Create a PowerShell script that adds all user accounts with one of the five job titles to the group. Create an Azure automation task to process the script once a day. Grant this group access to the SalesForce application in Azure AD.