A security analyst at Contoso notices that Microsoft Entra ID Protection has flagged a user account with a 'High' user risk level. Investigation shows the user's credentials were found in a leaked credential database on the dark web. The analyst wants Entra ID to automatically force these users to securely reset their password the next time they sign in, without manual intervention. Which type of policy should the analyst configure?