Your company has a Microsoft 365 subscription. You need to implement multi-factor authentication (MFA) by using a risk-based conditional access policy. What should you do first?
a) Configure MFA settings in Microsoft 365
b) Assess the organization's risk factors
c) Notify employees about the MFA implementation
d) Update the operating system