Which Azure AD capability should you configure to require multi-factor authentication for users accessing applications from untrusted networks?

Conditional Access is the correct choice because it allows you to enforce policies based on various conditions, including user location (network), device state, and application being accessed. You can configure a policy to require multi-factor authentication (MFA) specifically when users attempt to access applications from untrusted or external networks, thereby enhancing security. Access reviews are for periodically checking who has access to resources. Managed identities provide Azure services with an automatically managed identity in Azure AD. Entitlement management helps manage access to groups, applications, and SharePoint sites for external users. These options do not directly address the requirement of enforcing MFA based on network location.