Skip to main content
This guide explains how to integrate Azure Prompt Shield with TrueFoundry to detect and block prompt injection and jailbreak attempts in your LLM applications.

​
What is Azure Prompt Shield?

Azure Prompt Shield is Microsoft’s AI-powered service for detecting prompt injection attacks and jailbreak attempts. It is part of the Azure AI Content Safety suite.

​
Key Features of Azure Prompt Shield

  1. User Prompt Attack Detection: Identifies direct prompt injection attempts in user messages, including jailbreak techniques that try to override system instructions or manipulate model behavior.
  2. Document Attack Detection: Detects indirect prompt injection attacks embedded in document content or context provided to the model — catching attacks that attempt to hijack the model through injected instructions in external data.

​
How to Set Up Azure Prompt Shield on Azure

1

Sign in to Azure Portal

Navigate to Azure Portal and sign in with your Azure credentials.
2

Create a Content Safety Resource

Select Create a resource and search for Azure AI Content Safety. Select Create.
3

Configure Resource Details

  • Subscription: Choose your Azure subscription
  • Resource group: Select existing or create new
  • Region: Select the region (e.g., East US)
  • Name: Enter a unique name for your Content Safety resource
  • Pricing tier: Choose the appropriate pricing tier
4

Create the Resource

Select Create to provision the resource. This may take several minutes.
5

Locate API Key and Resource Name

Once created, navigate to the Overview section. Note the Resource Name and go to Keys and Endpoint to get your API Key.
Azure Portal showing Content Safety resource overview with Resource Name and Keys highlighted

Locate API Key and Resource Name in Azure Portal

​
Adding Azure Prompt Shield Guardrail Integration

To add Azure Prompt Shield to your TrueFoundry setup, follow these steps: Fill in the Guardrails Group Form
  • Name: Enter a name for your guardrails group.
  • Azure Prompt Shield Config:
    • Name: Enter a name for the guardrail configuration
    • Resource Name: Your Azure Content Safety resource name
    • API Version: The API version to use (Default: 2024-09-01)
  • Azure Authentication Data:
    • API Key: Your Azure Content Safety API key
As an alternative to API keys, you can authenticate via Microsoft Entra ID using certificate-based authentication, client secret based authentication, or workload identity federation.
TrueFoundry interface for configuring Azure Prompt Shield with fields for name, resource name, API version, and authentication

Fill in the Azure Prompt Shield Guardrail Form

​
Configuration Options

See Guardrails Overview for details on Operation Modes and Enforcing Strategy.

​
How Azure Prompt Shield Works

When integrated with TrueFoundry, the system sends the user prompt and any document content to the Azure Prompt Shield API. The response indicates whether attacks were detected in the user prompt or in documents.

​
Response Structure

Result: Request will be blocked by the guardrail
Result: Request will be allowed by the guardrail

​
Validation Logic

  • If userPromptAnalysis.attackDetected is true, the content is blocked
  • If any entry in documentsAnalysis has attackDetected: true, the content is blocked
  • The violation message indicates where the attack was found: "Prompt shield violation: user prompt attack" or "Prompt shield violation: document attack"
Example: Jailbreak Blocked:
Example: Indirect Injection Blocked: