A security analyst at Contoso notices that several user accounts are being accessed from atypical locations and from IP addresses associated with anonymous VPN services. The analyst wants an automated Microsoft Entra capability that detects these risk-based signals, assigns a risk level to sign-ins and users, and can trigger remediation such as forcing a password reset. Which capability should the analyst use?