CA-08: Block Access from High-Risk Countries

CA-08 is a security control that blocking access from high-risk countries reduces geopolitical risk and helps comply with export control regulations (itar, ear). while vpns can bypass this control, it stops opportunistic attacks and reduces your attack surface from nation-state threat actors. It requires that conditional access policy blocks access from high-risk countries and country-based named location configured with sanctioned/high-risk nations, level 1: north korea, iran, syria, level 2: + russia, cuba, level 3: + china, belarus, venezuela.

Blocking access from high-risk countries reduces geopolitical risk and helps comply with export control regulations (ITAR, EAR). While VPNs can bypass this control, it stops opportunistic attacks and reduces your attack surface from nation-state threat actors.

TrueConfig provides one-click remediation for CA-08. Creates country-based named location and blocking CA policy. Emergency accounts are excluded.

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

CA-08 is included in the TrueConfig Recommended Secure baseline (Level 1). This is the foundation level suitable for most organizations.