A holding company has recently acquired two new businesses, each with its own Okta identity...

Basic Concept: CIE can integrate multiple identity providers into one tenant and use segments to control redistribution by business unit or firewall group.

Why A is Correct: A single tenant with Okta connections and segments provides the required isolation with the least operational overhead.

Why B is Wrong: Configure the firewalls for each company to query their respective Okta IdPs directly, bypassing CIE for redistribution. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why C is Wrong: Push all identity data to Panorama and use Panorama's group mapping include/exclude lists to control what each firewall learns. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.

Why D is Wrong: Create a master CIE tenant for the holding company and peer it with two subordinate tenants, one for each acquired business. is a valid Palo Alto Networks or networking concept in another context, but it does not implement the exact configuration outcome required by this question.