Your organization uses the Microsoft Authenticator app for multifactor authentication. Users report receiving repeated push notifications they did not initiate, and one employee accidentally approved a fraudulent sign-in. You need to reduce the risk of users blindly approving malicious MFA prompts while continuing to use the Authenticator app. Which capability should you enable?