Imagine an organization that uses cloud$-$based applications and has many employees who work remotely. If the administrator wants to reduce the attack surface and increase visibility over user activity, which of the following security strategies should they employ?