Anya, a network security engineer at a rapidly growing tech firm, is facing a challenge in enforcing granular application control policies on their FortiGate firewall. The current setup relies on static IP address assignments to define user groups for policy application, which has become cumbersome to manage due to frequent user onboarding and offboarding. Anya needs to implement a more dynamic and scalable solution to restrict access to a newly adopted cloud-based project management suite for specific departments, while ensuring seamless access for others. Considering the need for adaptability and the adoption of new methodologies in network security, what is the most effective strategic pivot Anya can make within FortiOS to achieve this objective, moving away from IP-based segmentation?