Microsoft Foundry

Capabilities

• Abuse Monitoring

  ObserveSecure Infrastructure Agents

  Detects recurring harmful content and misuse patterns in Azure OpenAI prompts and completions, and flags potentially abusive users through content classification and pattern scoring. Surfaces Risks & Safety monitoring signals so teams can respond to misuse of deployed models.

• Agent Action Control

  Secure Agents

  Keeps agent actions aligned with user intent using Task Adherence, which detects misaligned tool invocations and improper tool input or output relative to intent and produces a signal to block the action or escalate to human-in-the-loop review. Task Adherence and the agent tool-call and tool-response intervention points are in preview.

• AI Red Teaming Agent

  Secure Agents Infrastructure

  Runs automated adversarial scans against models and Foundry agents — simulating prompt injection, jailbreak, and agentic attacks with PyRIT strategies — and scores each attempt with an Attack Success Rate to surface safety and security weaknesses before deployment. In preview.

• Data and Secret Control

  SecureGovern Data Infrastructure

  Keeps agent data, secrets, keys, and vector state under customer control through customer-managed keys in Azure Key Vault or Managed HSM and the standard agent setup that brings your own Storage, Azure AI Search, and Cosmos DB. All agent data — threads, messages, files, and vector stores — stays in the customer tenant, isolated by project.

• Diagnostic Logging and Tracing

  Observe Infrastructure Agents

  Emits the Foundry-native evidence that feeds enterprise SecOps: diagnostic settings that route resource logs to Log Analytics, Storage, or Event Hubs, and agent tracing through Application Insights using OpenTelemetry to capture prompts, outputs, tool calls, latency, token usage, and errors. Tracing is off by default and can contain personal data and customer content.

• Gateway and Tool Mediation

  SecureGovern Agents Infrastructure

  Routes model and MCP tool traffic through a governed AI Gateway backed by Azure API Management, enforcing per-project token-per-minute rate limits and total token quotas and governing external tool access with authentication, rate limits, IP restrictions, and audit logging. MCP tool governance is in preview.

• Guardrail Enforcement

  GovernSecure Agents Infrastructure

  Mandates a minimum safety bar across deployments using guardrail policies and the Control Plane compliance workspace, which surfaces coverage gaps and policy violations and enforces content filtering and abuse detection through Azure Policy. Agent guardrails are in preview and apply only to agents developed in the Foundry Agent Service, not other agents registered in the Control Plane.

• Identity and Access Boundary

  SecureGovern Infrastructure Agents

  Governs who administers Foundry resources, builds in projects, and invokes agents through Microsoft Entra ID role-based access control, separating control-plane from data-plane roles and offering least-privilege options like the Foundry Agent Consumer role and per-agent scopes. Removes static API keys by enforcing token-based authentication and disabling local auth.

• Model Deployment Governance

  Govern Infrastructure Agents

  Blocks unapproved or immature models from reaching projects using two built-in Azure Policy definitions evaluated at deployment time: an approved-models allow-list by model or publisher, and an eligibility-requirements policy that can require Direct-from-Azure sourcing and deny Preview models. The eligibility-requirements policy is in preview.

• Network Isolation

  Secure Infrastructure

  Constrains inbound and outbound Foundry traffic so model, agent, tool, storage, and retrieval interactions avoid public exposure. Combines Private Link and public-network-access controls for inbound with a Microsoft-managed virtual network and managed private endpoints for agent outbound traffic, reducing data exfiltration risk.

• Prompt and Injection Protection

  Secure Agents Data

  Defends against direct and indirect prompt attacks at runtime with Prompt Shields, which detect user-prompt attacks and indirect (cross-prompt or document) injection, and Spotlighting, which tags untrusted content as lower trust. Prompt Shields are generally available for models but preview on agents; Spotlighting applies to model deployments only, not agents.

• Risk & Safety Evaluators

  SecureGovern Agents Infrastructure

  Scores model and agent outputs against built-in risk and safety evaluators — including groundedness, indirect prompt injection (XPIA), prohibited actions, and sensitive data leakage — so teams can gate releases and catch unsafe behaviour before deployment. Runs from the Azure AI Evaluation SDK or the Foundry portal and feeds results back into observability.

• Sensitive Output Protection

  Secure Data Agents

  Reduces sensitive, harmful, or protected output with harmful-content filters for hate, sexual, self-harm, and violence, protected-material detection for text and code, and a PII filter. Harm filters and protected material are generally available for models; the PII filter is in preview, and enforcement on agents is preview.