Contoso wants to enable Privileged Identity Management (PIM) and Microsoft Entra ID Protection risk-based policies for its administrators. Which Microsoft Entra ID edition must the company assign to the affected users to use these features?