A security administrator wants to introduce a new Conditional Access policy that requires multifactor authentication for all users accessing the finance application. Before enforcing it, the administrator needs to understand how the policy would affect sign-ins without actually blocking or prompting any users. Which configuration should the administrator use when creating the policy?