Your organization uses Google Workspace and wants to integrate it with an on-premises Active Directory via GCDS. The goal is to ensure that any user deactivated in the Active Directory should be automatically suspended in Google Workspace. What is the best way to achieve this?