A security analyst at Contoso wants Microsoft Entra to automatically respond at the moment of authentication when a specific sign-in appears suspicious — for example, when the sign-in originates from an anonymous IP address or an unfamiliar location. The response should require the user to complete multi-factor authentication only for that questionable sign-in attempt, without permanently flagging the user account. Which Microsoft Entra ID Protection capability should the analyst configure?