A company wants to block commonly used weak passwords and organization-specific terms in supported password-change scenarios. Which capability should it configure?

1. An email retention policy
2. A source-code branch policy
3. A VM shutdown schedule
4. Microsoft Entra Password Protection with appropriate banned-password configuration