CA-12: Conditional Access for Workload Identities

CA-12 is a security control that service principals authenticate without user interaction and often have broad permissions. without ca policies, a compromised service principal has unrestricted access. workload identity ca policies enable location-based and risk-based controls for non-human identities. It requires that a conditional access policy targets service principal authentication and high-risk workload identities are covered by risk-based policies, policy is in enforced (not report-only) state.

Service principals authenticate without user interaction and often have broad permissions. Without CA policies, a compromised service principal has unrestricted access. Workload identity CA policies enable location-based and risk-based controls for non-human identities.

TrueConfig provides one-click remediation for CA-12. Creates CA policy targeting workload identities in report-only mode. Requires Workload Identities Premium license.

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

CA-12 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.