A security administrator wants to require multi-factor authentication only when users sign in from outside the corporate network, while allowing seamless access from trusted office locations. Which Microsoft Entra capability lets the administrator enforce this based on signals such as user location?