CA-04: Remediate High-Risk Users Automatically

CA-04 is a security control that when microsoft detects that a user's credentials have been leaked (dark web, breach databases), the user risk policy forces a password change before the attacker can use those credentials. It requires that an identity protection user risk policy is enabled and high-risk users are required to change their password, leaked credentials detections trigger immediate remediation.

When Microsoft detects that a user's credentials have been leaked (dark web, breach databases), the user risk policy forces a password change before the attacker can use those credentials.

TrueConfig provides one-click remediation for CA-04. Creates user risk policy in Identity Protection

This control requires Azure AD Premium P2 (included in Microsoft 365 E5) or standalone P2.

CA-04 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.