Your organization has an on-premises Active Directory environment and a Microsoft 365 E5 license. You're tasked with preparing for directory synchronization and need to identify potential issues while adhering to the principle of least privilege. Which combination of tool and group membership should you use?