Azure: Content Safety and the Foundry stack
Lesson 3 of 5 in Guardrails in the Cloud: Implementing Controls on AWS, Azure, and GCP.
Microsoft’s guardrail layer is Azure AI Content Safety — a standalone service that also powers the default content filters wired into every Azure OpenAI deployment. Its core move is classification with graded severity: text and images are scored across four harm categories — hate and fairness, sexual, violence, and self-harm — on a severity scale reported as safe (0), low (2), medium (4), and high (6) (the underlying text model scores 0–7). You choose, per category and separately for prompts and completions, the severity at which to block.
That threshold choice is a governance decision wearing an engineering costume. Azure OpenAI ships with defaults that block at medium severity — a reasonable general-purpose posture — but a children’s education product should block low-and-above, while a content-moderation tool that must examine harmful text may need permissive input filters paired with strict output filters. Whoever sets these numbers is doing applied risk management; the configuration file should say why.
Prompt Shields
One API against two different attacks. User prompt attacks (direct jailbreaks): the user tries to talk the model out of its rules — persona swaps, 'ignore previous instructions', encoded-output tricks. Indirect attacks (cross-domain prompt injection, XPIA): the malicious instruction hides in a document the system processes — an email, a webpage, a PDF in the RAG corpus — and the model follows it as if the operator had asked. Indirect attacks are the more dangerous class for enterprise systems, because attackers reach your model through content you ingest, and detecting them requires marking document boundaries in the prompt so the shield knows which text is untrusted.
Groundedness detection
Verifies whether LLM responses are grounded in the source material you supplied, flagging ungrounded claims — Azure’s counterpart to Bedrock’s contextual grounding check. A correction mode can rewrite the ungrounded sentence rather than just flag it. Check current docs for its rollout status — it has lived in preview, in selected regions, and its integration points keep moving.
Protected material
Two detectors aimed at intellectual-property leakage: protected material for text flags known copyrighted content (song lyrics, articles, recipes, selected web content) in model output; protected material for code flags output matching known public-repository code so it is not reproduced uncredited. These exist because generative models memorise — and because copyright plaintiffs subpoena.
Guardrails filter requests; evaluations measure the system. Foundry ships a library of built-in evaluators you can run pre-deployment and continuously in production: quality metrics (coherence, fluency), RAG metrics (groundedness, relevance), and risk-and-safety evaluators that score outputs for hateful, violent, sexual, and self-harm content, indirect-attack susceptibility, protected material, and code vulnerabilities — aggregated into a defect rate per risk. An adversarial simulator generates attack datasets when you have none, and the AI red-teaming agent (built on Microsoft’s open-source PyRIT) automates red-teaming scans against your endpoint. Tracing, built on OpenTelemetry and landing in Application Insights, records the execution flow — every model call, tool invocation, and agent step — which is what lets you reconstruct why an agent did what it did after the fact.
Around the platform sit the estate-wide controls. Microsoft Purview handles data governance where AI meets your information estate: its Data Security Posture Management (DSPM) surfaces which AI apps are touching sensitive data, its DLP policies can block users from pasting sensitive information into AI apps (including third-party ones), sensitivity labels follow documents into RAG pipelines, and prompts and responses can be captured for audit and eDiscovery. Azure Policy enforces platform posture ('no model deployment without a content-filter policy attached'), and RBAC decides who may deploy models or weaken a filter configuration at all.
Interactive sorting exercise: Sort each Azure capability into the guardrail layer where it operates.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.