An organization wants a stolen password alone to be insufficient for employee sign-in. Which approach best fits?

1. Enforce appropriate two-step verification with a planned enrollment process.
2. Configure context-aware access with the necessary licensing and tested conditions.
3. Delegate a suitable limited administrative role.
4. Evaluate security keys or passkeys under the applicable authentication policy.