Your organization uses Microsoft Entra ID Protection with Entra ID P2 licenses. The security team reports that several user accounts are frequently flagged with a high user risk level due to leaked credentials found on the dark web. Leadership wants an automated response that forces affected users to prove ownership of their account and reset their password, while allowing them to self-remediate without a helpdesk call. Users are already registered for SSPR and MFA. What should you configure?