A financial services company wants to ensure that IT administrators do not hold standing administrative privileges. Instead, admins should request elevated access only when needed, receive time-limited role activation, and be required to justify each activation with approval and MFA. Which Microsoft Entra capability should the company implement?