AI Defense Stack

LLM firewalls & guardrails

Azure AI Content Safety: cloud API for harmful content and prompt attacks

Azure AI Content Safety is a cloud API for harmful content and prompt attacks from Microsoft. It is a commercial product offered as: API, Cloud-native, Managed service. Pricing model: freemium. The vendor's page now calls it Content Safety in Foundry Control Plane.

  • Last reviewed
Visit Azure AI Content Safety (opens in a new tab) Documentation (opens in a new tab)
Commercial Freemium Renamed Layer 6: Runtime guardrails

Best for

Teams that build on Azure or Foundry and want managed APIs for content moderation and prompt attack detection

Ownership

Microsoft's Azure blog banner says Azure AI Content Safety is now Content Safety in Foundry Control Plane, and the Azure product page uses the new name. Microsoft Learn docs still say Azure AI Content Safety. Source, checked October 21, 2026: azure.microsoft.com (opens in a new tab)

Consider instead if

  • You build on AWS and want a comparable managed service. See Bedrock Guardrails.
  • You want an open-source toolkit you can run on your own infrastructure. See NeMo Guardrails.

What Azure AI Content Safety does

Azure AI Content Safety is a Microsoft cloud service with text and image APIs for detecting harmful content in user-generated and AI-generated material. For LLM apps, the documentation lists Prompt Shields for user prompt attacks and document attacks, groundedness detection (preview), protected material detection, a task adherence API for agent tool use, and custom categories. In Azure AI Foundry, Prompt Shields can run as guardrail controls on model deployments and agents. It is a closed-source managed service with a free tier and a standard tier. Microsoft notes that Prompt Shields are trained and evaluated mainly on English content, so check results for other languages.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Microsoft Source, checked October 21, 2026: learn.microsoft.com (opens in a new tab)
Status
Renamed Source, checked October 21, 2026: azure.microsoft.com (opens in a new tab)
Current name
Content Safety in Foundry Control Plane Source, checked October 21, 2026: azure.microsoft.com (opens in a new tab)
Ownership
Microsoft's Azure blog banner says Azure AI Content Safety is now Content Safety in Foundry Control Plane, and the Azure product page uses the new name. Microsoft Learn docs still say Azure AI Content Safety. Source, checked October 21, 2026: azure.microsoft.com (opens in a new tab)
Open source
No: closed source (proprietary) Source, checked October 21, 2026: learn.microsoft.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
API, Cloud-native, Managed service Source, checked October 21, 2026: learn.microsoft.com (opens in a new tab)
Pricing model
Freemium: Free tier: 5,000 text records and 5,000 images per month, with no overages. Standard tier is billed per 1,000 text records; a text record is up to 1,000 Unicode code points. (as listed on October 21, 2026; check the vendor for current pricing) Source, checked October 21, 2026: azure.microsoft.com (opens in a new tab)
Website
azure.microsoft.com Source, checked October 21, 2026: azure.microsoft.com (opens in a new tab)
Documentation
learn.microsoft.com Source, checked October 21, 2026: learn.microsoft.com (opens in a new tab)
API reference
learn.microsoft.com Source, checked October 21, 2026: learn.microsoft.com (opens in a new tab)
Quickstart
learn.microsoft.com Source, checked October 21, 2026: learn.microsoft.com (opens in a new tab)
Security page
Not documented in the sources we checked
Attestations or disclosure
Not documented in the sources we checked

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where Azure AI Content Safety fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that Azure AI Content Safety covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L6 Runtime Runtime guardrails Primary Screen what goes into and comes out of a model in live traffic, and limit abuse of the model endpoint. Follows its category, LLM firewalls & guardrails
L7 Agent access Agent and tool access Also covers Documents a task adherence API that checks how an agent uses its tools. Detects agent tool use that is misaligned, unintended or premature with the task adherence API

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to Azure AI Content Safety, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Prompt Shields detect user prompt attacks and document attacks. Detects user prompt attacks that try to bypass system instructions or safety training; Detects jailbreak patterns through the user prompt shield, previously called jailbreak risk detection
LLM06 Excessive Agency The task adherence API flags misaligned or premature agent tool use. Detects agent tool use that is misaligned, unintended or premature with the task adherence API
LLM09 Misinformation Groundedness detection (preview) checks responses against source material. Detects whether LLM text responses are grounded in the source material (preview)

Not mapped in our analysis: LLM02, LLM05, LLM07, LLM10. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in LLM firewalls & guardrails, ranked within the category by Coverage Score.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

Portkey AI Gateway

Palo Alto Networks (Portkey)

Open sourceMIT Freemium Now Prisma AIRS AI Gateway
  • SaaS
  • Self-hosted
  • API

Routes LLM traffic through one gateway API and runs input and output guardrail checks on each request.

Best for: Teams that want a single gateway for several LLM providers with guardrail checks, available as open source or as a hosted service

Coverage Score 69 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM09 Misinformation

Reviewed

Kong AI Gateway

Kong

Open sourceApache-2.0
  • Self-hosted
  • SaaS
  • API

Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.

Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane

Coverage Score 65 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

Head-to-head comparisons

Azure AI Content Safety FAQ

Is Azure AI Content Safety open source?

No. It is a managed Azure service, and the documentation links no source repository for it.

What does Prompt Shields detect?

Microsoft's page describes user prompt attacks that try to bypass system instructions, and document attacks, which are hidden instructions inside documents, emails or web pages.

Is there a free tier?

Yes. The pricing page lists a free tier of 5,000 text records and 5,000 images per month, and a standard tier billed per 1,000 text records.

Key facts you can cite

We have no commercial relationship with Microsoft.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.