Professional Cloud DevOps Engineer

During bootstrapping of a new Google Cloud organization, the security team wants to onboard existing Microsoft Active Directory users into Cloud Identity while keeping the on-premises directory as the source of truth. Which approach aligns with Cloud Identity's documented capability?

As part of maintaining the organization's security posture, you must enforce granular, dynamic access controls to Google Cloud resources based on a user's identity and the context of each request, without deploying a traditional VPN. Which Cloud Identity capability meets this requirement?