An enterprise customer of AEM as a Cloud Service sets up Federated SSO in Admin...

To automate user and group management between an enterprise directory (like Azure AD) and AEM as a Cloud Service, direct LDAP connections to AEM are no longer supported. Instead, identity is managed centrally in the Adobe Admin Console. The DevOps engineer must deploy the Adobe User Sync Tool (UST) on a secure corporate server (Option E). The UST automatically syncs AD groups to the Admin Console. Furthermore, to ensure these federated users can actually log into AEM, the engineer must map a catch-all Azure AD group to the baseline "AEM Users" Product Profile within the Admin Console (Option B).