CA-01: Require MFA via Conditional Access Policy

CA-01 is a security control that conditional access policies provide granular mfa enforcement with proper exclusions. unlike security defaults, ca policies allow you to exclude emergency access accounts while still protecting all users. It requires that at least one conditional access policy requires mfa for all users and policy applies to all cloud applications, emergency access accounts are excluded, policy state is enabled (not report-only).

Conditional Access policies provide granular MFA enforcement with proper exclusions. Unlike Security Defaults, CA policies allow you to exclude emergency access accounts while still protecting all users.

TrueConfig provides one-click remediation for CA-01. Creates a Conditional Access policy requiring MFA for all users

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

CA-01 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.

CA-01 is rated critical because failure to implement this control significantly increases the risk of security incidents. Conditional Access policies provide granular MFA enforcement with proper exclusions. Unlike Security Defaults, CA policies allow you to exclude emergency access accounts while still protecting all users.