Which Azure feature lets administrators write rules like "block sign-ins from outside India unless MFA is satisfied" and enforce them at sign-in time?

Conditional Access evaluates signals (user, location, device compliance, app, risk) at sign-in and applies controls (allow, block, require MFA, require compliant device). Bastion is jump-host SSH/RDP, ARM templates are IaC, the Calculator estimates cost — none are sign-in policies.