An enterprise uses GitHub Enterprise Cloud (not EMU) with SAML SSO already configured against Microsoft Entra ID. The security team wants organization team membership to be governed centrally by Entra ID security groups, so that when a user is added to or removed from an Entra group, their membership in the corresponding GitHub team updates automatically. They do NOT want to manage user accounts or provisioning through this mechanism. Which GitHub feature should the administrator enable to meet this requirement?