CA-02: Require MFA for All Administrators

CA-02 is a security control that administrator accounts are prime targets for attackers. even if mfa is required for all users, a dedicated policy for admins ensures they cannot bypass mfa under any condition and provides visibility into admin authentication. It requires that a conditional access policy targets the directory roles condition and policy includes all privileged administrator roles, mfa is required on every sign-in (not just from untrusted locations).

Administrator accounts are prime targets for attackers. Even if MFA is required for all users, a dedicated policy for admins ensures they cannot bypass MFA under any condition and provides visibility into admin authentication.

TrueConfig provides one-click remediation for CA-02. Creates a Conditional Access policy requiring MFA for all admin roles

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

CA-02 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.

CA-02 is rated critical because failure to implement this control significantly increases the risk of security incidents. Administrator accounts are prime targets for attackers. Even if MFA is required for all users, a dedicated policy for admins ensures they cannot bypass MFA under any condition and provides visibility into admin authentication.