CA-03: Block or Require MFA for Risky Sign-Ins
Frequently asked questions about implementing and managing the CA-03 security control in Microsoft 365 and Entra ID.
QWhat is CA-03 (Block or Require MFA for Risky Sign-Ins)?▼
CA-03 is a security control that microsoft analyzes each sign-in for anomalies (impossible travel, anonymous ip, malware-linked ips). risk-based policies automatically escalate protection when threats are detected, without user friction during normal access. It requires that an identity protection sign-in risk policy is enabled and high-risk sign-ins are blocked, medium-risk sign-ins require mfa.
QWhy is Block or Require MFA for Risky Sign-Ins important for Microsoft 365 security?▼
Microsoft analyzes each sign-in for anomalies (impossible travel, anonymous IP, malware-linked IPs). Risk-based policies automatically escalate protection when threats are detected, without user friction during normal access.
QHow do I implement CA-03 in my tenant?▼
TrueConfig provides one-click remediation for CA-03. Creates sign-in risk policy in Identity Protection
QWhat license do I need for CA-03?▼
This control requires Azure AD Premium P2 (included in Microsoft 365 E5) or standalone P2.
QWhich security baseline includes CA-03?▼
CA-03 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.
5
Questions
1
Related Controls
—
Categorized
Related Resources
Still have questions?
Our security experts are here to help. Start a free trial and get personalized guidance for your Microsoft 365 environment.
Start Free Trial