Region availability and service limits

Guardrails in Foundry

Microsoft Foundry supports global, data zone, and regional deployments to meet different compliance requirements. Guardrails follow the model or agent deployment configuration: regional deployments keep Guardrails processing in-region, while global deployments use global processing. Some features are available only with global or data zone deployments.

Availability for Guardrails in Microsoft Foundry

Guardrail brazilsouth canadacentral canadaeast centralus eastus eastus2 northcentralus southcentralus westus westus3
Content harms ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
Prompt shields ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
Protected material ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
Groundedness - - ✅ - ✅ ✅ - - ✅ -
Task Adherence* ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
Content provenance detection ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
Blocklists ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
PII ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅

*Only available in Global, US Datazone, and EU Datazone deployments.

Guardrails in Azure AI Content Safety

When you use Azure AI Content Safety directly, create the resource in the region where you want data processed. Features that support regional processing remain within that region. Some features require global or data zone routing. Although you can enable them in any supported Azure AI Content Safety region, customer data might be routed to and processed outside the resource’s region.

Availability for guardrails in Azure AI Content Safety

Guardrail brazilsouth canadacentral canadaeast centralus eastus eastus2 northcentralus southcentralus westus westus2 westus3
Content harms text - - ✅ ✅ ✅ ✅ ✅ ✅ - ✅ ✅
Content harms image - - ✅ ✅ ✅ ✅ ✅ ✅ - ✅ ✅
Prompt shields - - ✅ ✅ ✅ ✅ ✅ ✅ - ✅ ✅
Protected material - - ✅ ✅ ✅ ✅ ✅ ✅ - ✅ ✅
Groundedness - - - - ✅ ✅ - - ✅ - -
Task Adherence - - - ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅
Content provenance detection ✅ ✅ ✅ ✅ ✅ ✅ ✅ ✅ - ✅ ✅

Service limits

Input limits for Guardrails in Foundry

The first 1000 characters for text scenarios will be moderated using Guardrails.

Input limits for Azure AI Content Safety

See the following list for the input requirements for each feature.

  • Analyze text API:
    • Default maximum length: 10K characters (split longer texts as needed).
  • Analyze image API:
    • Maximum image file size: 4 MB
    • Dimensions between 50 x 50 and 7200 x 7,200 pixels.
    • Images can be in JPEG, PNG, GIF, BMP, TIFF, or WEBP formats.
  • Analyze multimodal API (preview):
    • Default maximum text length: 1K characters.
    • Maximum image file size: 4 MB
    • Dimensions between 50 x 50 and 7200 x 7,200 pixels.
    • Images can be in JPEG, PNG, GIF, BMP, TIFF, or WEBP formats.
  • Prompt Shields API:
    • Maximum prompt length: 10K characters.
    • Up to five documents with a total of 10K characters.
  • Groundedness detection API (preview):
    • Maximum length for grounding sources: 55,000 characters (per API call).
    • Maximum text and query length: 7,500 characters.
    • Minimum query length: 3 words.
  • Protected material detection APIs:
    • Default maximum length: 10K characters.
    • Default minimum length: 110 characters (for scanning LLM completions, not user prompts).
  • Custom categories (standard) API (preview):
    • Maximum inference input length: 1K characters.
  • Task adherence (preview):
    • Maximum input length: 100K characters.

Language considerations

Guardrail classification performance can vary by language. A model's ability to process a language doesn't mean that the control was specifically trained and tested for that language or that performance is equivalent across languages.

The text classifiers for Hate, Sexual, Violence, and Self-harm are trained and tested on Chinese, English, French, German, Italian, Japanese, Portuguese, and Spanish. These classifiers have multilingual capabilities and can classify content in other languages, but those languages aren't included in the trained-and-tested set and performance can vary.

Prompt Shields for user prompt attacks and document attacks also have multilingual capabilities, but they're primarily trained and evaluated on English content. Performance can vary for non-English content.

Protected material, groundedness detection, task adherence, and custom categories (standard) were trained and evaluated on English content. However, these features can work in many other languages, but the quality might vary.

In all cases, you should do your own testing to ensure that it works for your application. Evaluate each control with representative harmful, attack, and benign content in every language used by your application. Review both false positives and false negatives. Language-specific vocabulary can affect results; for example, a word that is benign in one language might resemble harmful terminology in another language and produce a false positive.

  • Last updated on