What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?

Northern Trail Outfitters (NTO) uses a Security Assertion Markup Language (SAML)-based Identity Provider (idP) to authenticate employees to all systems. The IdP authenticates users against a Lightweight Directory Access Protocol (LDAP) directory and has access to user information. NTO wants to minimize Salesforce license usage since only a small percentage of users need Salesforce.

What is recommended to ensure new employees have immediate access to Salesforce using their current IdP?
A . Install Salesforce Identity Connect to automatically provision new users in Salesforce the first time they attempt to login.
B . Build an integration that queries LDAP periodically and creates new active users in Salesforce.
C . Configure Just-in-Time provisioning using SAML attributes to create new Salesforce
users as necessary when a new user attempts to login to Salesforce.
D . Build an integration that queries LDAP and creates new inactive users in Salesforce and use a login flow to activate the user at first login.

Answer: C