A security administrator notices that several sign-ins to Microsoft 365 are occurring through older email clients that do not support modern authentication, and these clients cannot enforce multi-factor authentication. The administrator wants to automatically block these legacy authentication attempts across the organization based on signals like the client app being used. Which Microsoft Entra capability should the administrator configure?