Default Guardrail policies for Microsoft Foundry

Microsoft Foundry Models include default safety policies that apply to all models, except transcription models. These configurations provide a responsible experience by default, including content harms, prompt shields, block lists, and other features.

Guardrails use classification models and configured actions to help identify and mitigate risks associated with various categories of harmful or inappropriate content. DefaultV2 safety includes controls for categories such as hate and fairness, sexual, violence, self-harm, protected material content, and user prompt attacks. Classification models can produce false positives and false negatives. Evaluate the controls with representative content from your workload. To learn more, see categories and severity levels.

Core-harm filters and user prompt attack detection are enabled by default. Document attack detection is off by default and must be enabled. Other controls have their own default states. Configuration availability and approval requirements vary by control. To learn more about configurability, see configuring Guardrails.

For the four core-harm categories, the default Medium blocking level blocks content classified at medium or high severity. Core-harm filters evaluate both user prompts (input) and model completions (output). User prompt attack detection evaluates user input. Document attack detection evaluates document content when that control is enabled. API behavior depends on whether the configured control blocks input or output; blocked input returns an error response, while blocked output can return a filtered completion.

Prerequisites

  • An Azure subscription with access to Azure OpenAI Service
  • Deployed Azure OpenAI models (excluding transcription models, which use different safety configurations)

DefaultV2 settings

Text models

Text models in Foundry can take in and generate both text and code. These models leverage Azure's text content filters to detect and prevent harmful content. This system works on both prompts and completions.

Risk category Prompt or completion Severity threshold
Hate and fairness Prompts and completions Medium
Violence Prompts and completions Medium
Sexual Prompts and completions Medium
Self-harm Prompts and completions Medium
User prompt injection attack (jailbreak) Prompts N/A
Protected material – text Completions N/A
Protected material – code Completions N/A

Image models

Vision-enabled chat models

Risk category Prompt or completion Severity threshold
Hate and fairness Prompts and completions Medium
Violence Prompts and completions Medium
Sexual Prompts and completions Medium
Self-harm Prompts and completions Medium
Identification of individuals and inference of sensitive attributes Prompts N/A
User prompt injection attack (jailbreak) Prompts N/A

Image generation models

Risk category Prompt or completion Severity threshold
Hate and fairness Prompts and completions Medium
Violence Prompts and completions Medium
Sexual Prompts and completions Medium
Self-harm Prompts and completions Medium
Content credentials Completions N/A
Deceptive generation of political candidates Prompts N/A
Depictions of public figures Prompts N/A
User prompt injection attack (jailbreak) Prompts N/A
Protected material – art and studio characters Prompts N/A
Profanity Prompts N/A

Audio models

Risk category Prompt or completion Severity threshold
Hate and fairness Prompts and completions Medium
Violence Prompts and completions Medium
Sexual Prompts and completions Medium
Self-harm Prompts and completions Medium
User prompt injection attack (jailbreak) Prompts N/A
Protected material - text Completions N/A
Protected material - code Completions N/A

Severity levels

Note

The text classifiers for Hate, Sexual, Violence, and Self-harm are trained and tested on Chinese, English, French, German, Italian, Japanese, Portuguese, and Spanish. The classifiers have multilingual capabilities and can classify content in other languages, but those languages aren't included in the trained-and-tested set and performance can vary. Evaluate both false positives and false negatives with representative content in every language used by your application.

Four-level text content

Warning

The Severity definitions tab in this document contains examples of harmful content that may be disturbing to some readers.

Image content

Warning

The Severity definitions tab in this document contains examples of harmful content that may be disturbing to some readers.

Testing safety policies

To verify that default safety policies are active, send a test prompt that should trigger content filtering. The following example uses the Azure OpenAI Python SDK with key-based authentication:

import os
from openai import AzureOpenAI

client = AzureOpenAI(
    api_key=os.environ["AZURE_OPENAI_API_KEY"],
    api_version="2024-10-21",
    azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
)

response = client.chat.completions.create(
    model=os.environ["AZURE_OPENAI_DEPLOYMENT"],  # your deployment name
    messages=[{"role": "user", "content": "[test prompt]"}],
)

print(response.choices[0].finish_reason)

Replace [test prompt] with content that exceeds one of the configured severity thresholds. If safety policies are active and the content is filtered, the request returns an HTTP 400 error with a content_filter code, or the response's finish_reason is content_filter with details indicating which category was triggered.

Next steps

  • Last updated on