A financial services company must ensure that when administrators access the Azure portal, they can only complete multi-factor authentication using phishing-resistant methods such as FIDO2 security keys or certificate-based authentication — while allowing standard users to continue using the Microsoft Authenticator app. Which Microsoft Entra capability lets administrators define and enforce which specific combinations of authentication methods satisfy an access requirement?