What is the first step to fix access for new SecOps users who authenticate to SecOps via a third-party IdP?

• A. Link SecOps to a Google Cloud project with the Chronicle API.
• B. Integrate SecOps with the third-party IdP using Workforce Identity Federation.
• C. Grant appropriate data access scope to the SOC team's IdP group in IAM.
• D. Grant roles/chronicle.viewer to the SOC team's IdP group in IAM.

Answer: (B)

Establishing a trusted connection with the external IdP using Workforce Identity Federation is the first step. This creates the bridge that lets users who authenticate through the third-party IdP be recognized by SecOps and enables you to map those IdP identities to Google Cloud IAM roles. Without this federation, identities from the IdP can’t be admitted or authorized in SecOps.

Once federation is in place, you can assign appropriate IAM roles to the IdP groups to grant access, or adjust data access scopes as needed. The other steps—linking to a Cloud project with the Chronicle API or granting scopes/roles to the IdP group— presuppose that the IdP identities are already federated and recognized by SecOps.