What is the recommended first action to enable SecOps access for new users who authenticate via a third-party IdP?

• A. Link SecOps to a Google Cloud project with the Chronicle API.
• B. Integrate SecOps with the third-party IdP using Workforce Identity Federation.
• C. Grant appropriate data access scope to the SOC team's IdP group in IAM.
• D. Grant Basic permission to the appropriate IdP groups in SecOps SOAR Advanced Settings.

Answer: (B)

Integrating SecOps with a third-party IdP using Workforce Identity Federation is the proper first step because it establishes a trusted connection that lets users sign in with their existing identity and have their IdP group memberships mapped to SecOps roles. This federated setup enables seamless single sign-on, centralized access control, and scalable onboarding for new users without creating separate SecOps accounts.

The other actions don’t address how new users authenticate via the external IdP. Linking SecOps to a Google Cloud project with the Chronicle API focuses on API access rather than user authentication. Granting data access scope in IAM controls resource permissions within Google Cloud, not the IdP-based sign-in flow. Granting Basic permission inside SecOps SOAR Advanced Settings is an internal permission setting and does not establish the federated authentication or group-to-role mapping that enables access for new IdP-based users.