To meet the requirement while keeping administrative work to a minimum, you should use a sign- in risk policy.
A sign-in risk policy (part of Microsoft Entra ID Protection, included with the P2 license) calculates the probability that a given authentication request was not initiated by the legitimate owner of the identity.
Untrusted Networks Signal: When a user attempts to log in from an unfamiliar IP address or an untrusted network, Microsoft Entra ID flags this context as a sign-in risk (such as an unfamiliar sign-in property or atypical travel). Automatic Mitigation: By enabling the built-in sign-in risk policy and configuring it to require multi-factor authentication (MFA) for medium or high-risk events, the system will automatically prompt the user for MFA during these exact scenarios.
Low Administrative Overhead: This is a pre-configured, out-of-the-box template policy. It eliminates the administrative effort of manually mapping, defining, and continuously updating named network locations or IP ranges.
Reference:
https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-risk-based-sign-in

Explanation:
Box 1: Smart lockout
Smart lockout helps lock out bad actors that try to guess your users' passwords or use brute- force methods to get in. Smart lockout can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other unknown sources. Attackers get locked out, while your users continue to access their accounts and be productive.
Box 2: Conditional access policies
If your environment is ready to block legacy authentication to improve your tenant's protection, you can accomplish this goal with Conditional Access.
How can you prevent apps using legacy authentication from accessing your tenant's resources?
The recommendation is to just block them with a Conditional Access policy. If necessary, you allow only certain users and specific network locations to use apps that are based on legacy authentication.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart- lockout
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy- authentication

Explanation:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events
https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog

Based on the requirements to handle user lifecycle (joiner-mover-leaver), ensure correct permissions, and conduct quarterly evaluations of those permissions, the Microsoft Entra Identity Governance solution that fits the bill best is Access Reviews.
While all components are part of the broader Identity Governance portfolio, Access Reviews specifically address the need for recurring (quarterly) evaluation of user access, role changes, and the revocation of permissions when users leave.
Here is why Access Reviews is the best fit among the options provided:
Quarterly Evaluation: Access reviews enable scheduled, automatic, or recurring (e.g., quarterly) reviews of user access to groups, applications, and roles.
Lifecycle and Mover/Leaver Support: They allow managers or resource owners to verify if a user's current permissions (including new roles) are still needed and can automatically remove access if denied.
Role Changes & Revocation: When a user changes roles or leaves the company, access reviews can be used to audit and revoke privileges, ensuring the "least privilege" principle is maintained.
Reference:
https://learn.microsoft.com/en-us/entra/id-governance/scenarios/automate-identity-lifecycle