A financial services company must comply with a regulatory mandate requiring phishing-resistant multifactor authentication for all administrators accessing Microsoft Entra ID. The security team wants to eliminate shared secrets and prevent credential phishing and man-in-the-middle attacks entirely. Users must be able to authenticate without entering a password. Which authentication method should you recommend?