A financial services company has just recovered from a ransomware incident where attackers compromised a domain admin account through credential theft. The CISO wants to follow Microsoft's guidance to systematically reduce privileged access risk. She asks the security architect which framework and initial focus to adopt to prioritize the fastest reduction in privileged access attack surface. Which recommendation best aligns with the Microsoft Cybersecurity Reference Architectures (MCRA)?