You have a new Azure subscription. You are developing an internal website for employees to view sensitive data. The website uses Microsoft Entra ID for authentication. You need to implement multifactor authentication for the website. Which two actions should you perform?