A company has noticed several sign-in attempts using stolen employee passwords. Leadership wants to reduce the risk that a stolen password alone allows an attacker to access company resources, without deploying certificates or hardware to every user. Which Microsoft Entra ID feature should you enable?