An organization just went through a substantial audit, and the top findings were orphaned and inactive privileged accounts. Given the scenario, which of the following would be the BEST method for addr

SSO with federation integration allows for centralized identity management. When integrated with automated provisioning (e.g., SCIM), changes to an account's status (deactivation, deletion) in the central identity provider are automatically propagated to all federated applications, ensuring accounts are deprovisioned and do not become orphaned or remain active when they shouldn't be.

ACLs and permissions verification manage *what* accounts can do, not whether the accounts themselves should exist or are active.

Multifactor authentication enhances the security of active accounts but does not address the problem of orphaned or inactive accounts.

Time-bound, just-in-time account provisioning is a valuable strategy for privileged access management to reduce standing privileges, but it does not provide the comprehensive lifecycle management across all accounts that federation offers for preventing orphaned and inactive accounts broadly.