A company wants group membership to update automatically whenever an employee's department attribute changes in Microsoft Entra ID, so users are added or removed from department-based groups without any manual administrator action. Which type of group should the administrator create?