In addition to using the Cloud Identity Engine to authenticate
users with its Cloud Authentication Service component, you can use
the Cloud Identity Engine’s Directory Sync component to
collect username-to-user group
mapping and enforce user- and group-based policy.