A Conditional Access policy for an administrative application must require phishing-resistant authentication. Acceptable methods include FIDO2 security keys, Windows Hello for Business, multifactor certificate-based authentication, and platform credentials. Which grant configuration should you use?