Your organization runs an Azure SQL Database that must comply with a new corporate security policy requiring all authentication to flow through Microsoft Entra ID. The compliance team wants to guarantee that no SQL authentication (username/password) logins can be used to connect, even if such logins already exist. You want to enforce this with the least ongoing administrative effort. What should you do?