An AWS Organization is managed by a security team and a DevOps team; both use IAM Identity Center (SSO). The DevOps group has a permission set named DevOps with AdministratorAccess attached and applied to all accounts. The security team attached an SCP at the organization root to prevent DevOps from accessing IAM Identity Center in the management account, but DevOps can still access it. What change will block DevOps from accessing IAM Identity Center in the management account?

The correct answer is to update the DevOps permission set with an explicit deny for sso: and sso-directory: actions, conditioned on aws:SourceAccount being the management account ID. This is because SCPs do not apply to the management account's root user or to IAM Identity Center service-linked roles, which are used for access. By modifying the permission set directly within IAM Identity Center, the explicit deny will take precedence and prevent the DevOps group from accessing IAM Identity Center specifically in the management account while still allowing full access elsewhere. The other options are incorrect because moving the management account to an OU does not change SCP behavior for the management account, modifying the SCP's condition is ineffective due to SCP limitations, and creating a new permission set with an explicit deny and assigning it to the DevOps group would override their existing full access, which is not the desired outcome.