Your organization uses AWS Organizations and has an IAM team that will manage AWS IAM Identity Center. The IAM team must have only the minimum permissions needed to administer Identity Center and must not obtain unnecessary access to the Organizations management account. The team must be able to create new Identity Center permission sets and assignments for both new and existing member accounts. Which combination of steps satisfies these constraints? (Choose three.)

To delegate Identity Center administration without granting full management account access, first enable Identity Center in the Organizations management account, then register a dedicated IAM team account as a delegated administrator. This allows the IAM team to manage Identity Center from their own account. Next, within Identity Center, create a permission set with the AWSSSOMemberAccountAdministrator managed policy, which provides the necessary permissions for Identity Center administration. Finally, assign this permission set to the IAM team's dedicated account, granting them the required access to manage Identity Center while adhering to the principle of least privilege and avoiding direct access to the Organizations management account.