How would you design a Conditional Access policy for a client with a highly mobile, remote workforce at Avanade?