Northern Trail Outfitters manages application functional permissions centrally as Active Directory groups.

When Salesforce receives a SAML assertion and needs to translate external directory group membership into Salesforce entitlements at login, Apex Just-in-Time provisioning is the right hook. A JIT handler can read custom SAML attributes, interpret the incoming group values, and then create or update the user record and assign the appropriate permission sets. Login flows run after authentication and are not the normal mechanism for parsing assertion content into provisioning logic. Standard SAML attributes also don’t carry every organization-specific group mapping, which is why custom attributes are typically used for permission translation. The design goal is to make access decisions based on identity-provider claims at sign-in, and the JIT Apex handler is where Salesforce expects that provisioning and entitlement logic to be implemented. This is why option A is the best answer in Salesforce terms.