A company wants a cloud-based identity service to manage employee accounts, enable single sign-on to Microsoft 365 and other SaaS applications, and centrally control who can sign in. Which Azure service should they use?