A small startup uses a free Microsoft Entra ID tenant and has no Conditional Access licenses. The IT administrator wants a quick, no-cost way to enforce multifactor authentication for all users, block legacy authentication protocols, and require administrators to always use MFA. Which capability should the administrator enable?