Your company runs a GitHub Enterprise Cloud account with Enterprise Managed Users (EMU) tied to Microsoft Entra ID. The security team wants to enforce Conditional Access policies (device compliance, sign-in risk) that are evaluated by Entra ID on every authentication to GitHub, without requiring an on-premises component to relay authentication state. Which identity federation protocol should you configure for the EMU enterprise to meet this requirement?