Which service should an enterprise configure to enforce conditional access policies based on user sign-in risk?

Azure AD Conditional Access is the correct service because it allows organizations to enforce policies based on various signals, including user sign-in risk. It integrates with Azure AD Identity Protection to assess risk levels and then apply appropriate access controls, such as requiring multi-factor authentication or blocking access. Azure Bastion provides secure RDP/SSH connectivity to virtual machines, not conditional access. Azure Blueprints help define repeatable sets of Azure resources, ensuring compliance and consistency, but don't enforce real-time access policies. Azure Monitor Alerts notify administrators about specific events or metrics, but they don't directly manage access control based on risk.