A security administrator needs to create a Conditional Access policy that requires a higher authentication assurance (step-up authentication) only when users attempt to perform model deployment operations in Azure AI Foundry—not for regular read access. Which Conditional Access feature implements this step-up authentication for a specific operation?

B is correct because Conditional Access authentication contexts allow applications to trigger step-up authentication for specific sensitive operations within the app. The Azure AI Foundry application can invoke an authentication context (e.g., 'c1') during the model deployment workflow, which triggers a Conditional Access policy requiring phishing-resistant MFA for that context. Users doing read-only operations do not trigger the context and face no step-up challenge. This provides granular, operation-level authentication control. A is wrong because a compliant device requirement applies to all access to the Azure AI Foundry app, not just specific operations—it cannot be scoped to the model deployment action. C is wrong because sign-in risk policies are risk-based and reactive; they require MFA when a risk is detected, not proactively for specific operations. D is wrong because named location restrictions block access by network location, not by operation type within the app.