Contoso wants group membership to update automatically whenever an employee's department changes in Microsoft Entra ID, so that users in the Sales department are always granted access to a specific set of applications without any manual intervention by administrators. Which type of group should the identity administrator create?