--- description: Configure Azure AI Content Safety in Bifrost to enable Jailbreak Shield, Indirect Prompt Injection Shield, and severity-based content filtering at the gateway. title: Configuring Azure AI Content Safety in Bifrost image: https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w1200/2026/07/configuring-azure-ai-content-safety-in-bifrost-bifrost-paper-waves.optimized.png --- Try Bifrost Enterprise free for 14 days. [Request access](https://www.getmaxim.ai/#enterprise-trial) **Configure Azure AI Content Safety in** [**Bifrost**](https://www.getmaxim.ai)** to enable Jailbreak Shield, Indirect Prompt Injection Shield, and severity-based content filtering at the gateway.** Prompt injection ranks as the highest-priority security risk for LLM applications in the [OWASP Top 10 for 2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/), covering both direct attacks in user input and indirect attacks hidden in retrieved content. Enforcing content safety inside each application leaves gaps every time a new service ships with a different filter version, and policy coverage drifts across teams. [Bifrost](https://www.getmaxim.ai), the [open-source AI gateway](https://github.com/maximhq/bifrost) built in Go by Maxim AI, moves content safety into the gateway, where every model call across every service inherits the same policy. This guide covers how to configure Azure AI Content Safety in Bifrost, including Jailbreak Shield, the Indirect Prompt Injection Shield, and severity filtering. ## What Azure AI Content Safety Detects Azure AI Content Safety is Microsoft's content moderation service that classifies text across four harm categories (hate, sexual, violence, and self-harm) and detects prompt injection attacks. In Bifrost, it runs as a [guardrail](https://docs.getbifrost.ai/enterprise/guardrails) profile that validates prompts and responses before they reach a model or return to a user. As a guardrail profile, Azure Content Safety provides: - **Severity-based content moderation** across hate, sexual, violence, and self-harm, with a configurable threshold of low, medium, or high. - **Jailbreak Shield**, Microsoft's Prompt Shield for detecting direct prompt injection attempts in user input. - **Indirect Prompt Injection Shield**, which detects malicious instructions embedded in external content such as documents, tool outputs, and retrieved passages. - **Custom blocklists** for organization-specific terms, plus optional copyright detection on outputs. Azure Content Safety focuses on content moderation and prompt-attack defense. It does not perform PII detection or output redaction, so teams that need those controls pair it with AWS Bedrock Guardrails or a regex profile on the same request. Detailed capability breakdowns are available on the [Bifrost guardrails resource page](https://www.getmaxim.ai/resources/guardrails). ## How Bifrost Structures Guardrails: Rules and Profiles Bifrost builds guardrails on two primitives: profiles and rules. A profile defines *how* content is evaluated, and a rule defines *when* and *what* gets evaluated. This separation lets a platform team configure credentials once and reference them from any number of downstream policies. - **Profiles** are provider configurations. An Azure Content Safety profile holds the endpoint, authentication, and detection settings. Profiles are reusable across rules. - **Rules** are CEL (Common Expression Language) expressions that determine when a check fires. A rule sets `apply_to` to `input`, `output`, or `both`, and links one or more profiles. A single rule can link multiple profiles, which run in parallel. This composability is the basis of defense in depth at the gateway. The full schema for [guardrail configuration in config.json](https://docs.getbifrost.ai/deployment-guides/config-json/guardrails) documents every provider and rule field. Guardrails are an enterprise capability and require the enterprise Bifrost image. ## Configuring an Azure AI Content Safety Profile To use Azure Content Safety in [Bifrost](https://www.getmaxim.ai), create an [`azure` guardrail provider profile](https://docs.getbifrost.ai/integrations/guardrails/azure-content-safety). The profile points at your Azure Content Safety resource endpoint and enables the specific shields and thresholds you want enforced. ```json { "guardrails_config": { "guardrail_providers": [ { "id": 3, "provider_name": "azure", "policy_name": "azure-content-safety", "enabled": true, "timeout": 10, "config": { "endpoint": "env.AZURE_CONTENT_SAFETY_ENDPOINT", "auth_type": "api_key", "api_key": "env.AZURE_CONTENT_SAFETY_KEY", "analyze_enabled": true, "analyze_severity_threshold": "medium", "jailbreak_shield_enabled": true, "indirect_attack_shield_enabled": true, "copyright_enabled": false, "text_blocklist_enabled": false, "sampling_rate": 100 } } ] } } ``` The profile supports three authentication modes: `api_key` (the default), `entra_id` for a service principal with `client_id`, `client_secret`, and `tenant_id`, and `default_credential` for managed identity or Azure CLI with no credentials in config. Managed identity is the cleaner option for Azure-hosted or [in-VPC deployments](https://docs.getbifrost.ai/enterprise/invpc-deployments), since no secret has to be stored or rotated. Credential and endpoint fields accept `env.VAR_NAME` references that Bifrost resolves from the process environment at startup. Three settings control detection behavior. `analyze_enabled` turns on severity-based text analysis, `jailbreak_shield_enabled` turns on direct prompt injection detection, and `indirect_attack_shield_enabled` turns on detection of hidden instructions in external content. All three default to their safe states, with `analyze_enabled` on by default and both shields off until explicitly enabled. Guardrails are part of the [Bifrost Enterprise](https://www.getmaxim.ai/enterprise) feature set. ## Jailbreak Shield: Blocking Direct Prompt Injection Jailbreak Shield detects direct prompt injection, where a user attempts to override the system instructions with input such as "ignore your previous instructions." Setting `jailbreak_shield_enabled` to `true` enables Microsoft's Prompt Shield on the prompt, and a rule scoped to `input` runs the check before the request is forwarded to a provider. A rule that applies the Azure profile to incoming prompts looks like this: ```json { "guardrails_config": { "guardrail_rules": [ { "id": 101, "name": "jailbreak-shield-input", "description": "Block direct prompt injection in user prompts", "enabled": true, "cel_expression": "true", "apply_to": "input", "sampling_rate": 100, "timeout": 10, "provider_config_ids": [3] } ] } } ``` Direct prompt injection is the most common form of the OWASP LLM01 risk, and Microsoft documents the detection model behind it in its overview of [Azure Prompt Shields](https://azure.microsoft.com/en-us/blog/enhance-ai-security-with-azure-prompt-shields-and-azure-ai-content-safety/). Enforcing the check at the gateway means every application pointed at Bifrost inherits jailbreak detection without changing application code. ## Indirect Prompt Injection Shield: Catching Hidden Instructions The Indirect Prompt Injection Shield detects malicious instructions embedded in content the model processes but the user did not type directly, such as a retrieved document, a web page, or a tool result. Setting `indirect_attack_shield_enabled` to `true` enables this detection on input validation, which is the relevant defense for RAG pipelines and agentic workflows. Indirect injection is harder to catch than direct injection because the payload arrives through trusted-looking data rather than the user message. An attacker plants instructions in a document that a retrieval step later pulls into context, and the instructions execute when the model reads them. This maps to OWASP LLM08 vector and embedding weaknesses as well as the indirect-injection half of LLM01. For agent stacks that call external tools, this matters most at the point where tool output and retrieved passages re-enter the model as input. Used as an [MCP gateway](https://www.getmaxim.ai/resources/mcp-gateway), Bifrost centralizes tool connections and can apply the same input content-safety rules to that context. Because the shield validates inputs, it inspects retrieved and tool-derived content as it flows into the request, giving agents a consistent boundary against hidden instructions regardless of which service makes the call. ## Severity Filtering for Content Moderation Severity filtering controls how aggressively Azure Content Safety blocks moderated content. The `analyze_severity_threshold` field accepts three values, and a request is flagged when detected content meets or exceeds the threshold across any of the four harm categories. - **low** (blocks severity 2 and above): the most aggressive setting, flagging content from low severity upward. - **medium** (blocks severity 4 and above): the default, balancing precision and coverage for most production traffic. - **high** (blocks severity 6 only): the most permissive setting, flagging only the most severe content. A single threshold rarely fits every workload. Customer-facing chat usually warrants a lower threshold than an internal engineering assistant. Because profiles are reusable and rules carry CEL expressions, [Bifrost](https://www.getmaxim.ai) supports separate profiles at different thresholds, each linked to a rule that matches by model, team, or another request attribute. A rule with `cel_expression` set to `model == 'gpt-4o'` applies one profile to that model, while a broader rule applies a different threshold elsewhere. ## Layering Azure Content Safety for Defense in Depth No single guardrail provider catches every failure mode, which is why a Bifrost rule can link multiple profiles that run in parallel on the same request. A common pattern pairs Azure Content Safety with GraySwan for content and jailbreak coverage, and AWS Bedrock with Patronus AI for PII and hallucination defense on regulated workflows. Because Azure Content Safety does not detect PII, teams that need both moderation and PII redaction layer it with a Bedrock profile or a regex profile. Bifrost applies the same policy across all configured [providers](https://docs.getbifrost.ai/providers/supported-providers/overview), so the controls hold whether traffic routes to OpenAI, Anthropic, or Azure OpenAI. For regulated industries, every guardrail decision is logged with the violation type, severity, action, and processing latency, producing the [audit trail](https://docs.getbifrost.ai/enterprise/audit-logs) that compliance reviews expect. Healthcare and other regulated teams can review the [healthcare and life sciences deployment patterns](https://www.getmaxim.ai/industry-pages/healthcare-life-sciences) and the [governance resource page](https://www.getmaxim.ai/resources/governance) for centralized policy and access control. Layering providers at the gateway is the model the [open-source Bifrost gateway](https://www.getmaxim.ai/resources/guardrails) is designed to run. ## Common Questions About Azure AI Content Safety in Bifrost ### Does Azure AI Content Safety detect PII in Bifrost? No. Azure Content Safety in Bifrost covers content moderation, jailbreak detection, and indirect prompt injection detection, but not PII detection or output redaction. Pair it with an AWS Bedrock profile, a Patronus AI profile, or a regex profile for PII coverage on the same request. ### Can I run Azure AI Content Safety on both inputs and outputs? Yes, with one distinction. Severity-based content analysis runs on both inputs and outputs, so set the rule's `apply_to` field to `both` to moderate prompts and completions. Jailbreak Shield and the Indirect Prompt Injection Shield apply to input validation only, and copyright detection applies to outputs only. Bifrost runs input rules before forwarding the request to the provider and output rules after the provider responds. ### What severity levels does Bifrost support for Azure content filtering? Bifrost supports three severity thresholds through the `analyze_severity_threshold` field: low, medium, and high. Medium is the default. Lower thresholds block more content; higher thresholds block only the most severe. ### Is Azure AI Content Safety available in the open-source gateway? Guardrails, including Azure Content Safety, are an enterprise feature and require the enterprise Bifrost image. The core gateway, routing, and provider access remain open source. ## Getting Started with Bifrost Configuring Azure AI Content Safety in Bifrost gives every application behind the gateway consistent Jailbreak Shield, Indirect Prompt Injection Shield, and severity filtering without per-service integration work. Define the profile once, link it to rules scoped by input, output, model, or team, and layer it with other providers for defense in depth. To see how Bifrost can centralize content safety and governance across your AI infrastructure, [book a demo](https://www.getmaxim.ai/book-a-demo) with the Bifrost team. ## Read next [![What Is AI Governance? A Definition for Engineering Teams](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/what-is-ai-governance-a-definition-for-engineering-teams-bifrost-1920x1080.png) AI governance is the set of policies, controls, and evidence that keeps an organization's AI use within agreed limits. This guide answers what is AI governance for engineers, mapping NIST AI RMF, EU AI Act, and ISO/IEC 42001 to runtime controls on model, MCP tool, and agent traffic.](https://www.getmaxim.ai/articles/what-is-ai-governance/) [![AI Security Policy Template for Teams Shipping LLM Apps](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/ai-security-policy-template-for-teams-shipping-llm-apps-bifrost-1920x1080.png) An AI security policy sets the rules for which data, models, tools, and agents an organization's AI systems may use. This template gives engineering teams 13 copy-ready clauses, mapped to the OWASP Top 10 for LLM Applications 2026 and NIST AI RMF, with the Bifrost control behind each one.](https://www.getmaxim.ai/articles/ai-security-policy-template/) [![EU AI Act Compliance for LLM Applications and Agents](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/10/eu-ai-act-compliance-for-llm-applications-and-agents-bifrost-1920x1080.png) EU AI Act compliance for LLM applications means mapping each feature to a risk category and producing evidence for logging, oversight, and transparency duties. This guide covers the post-Omnibus timeline, the engineering obligations, and where an AI gateway helps and where it stops.](https://www.getmaxim.ai/articles/eu-ai-act-compliance-llm-applications/) ## More in AI Governance [![Google Model Armor Guardrails with Bifrost](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/07/google-model-armor-guardrails-with-bifrost-bifrost-paper-waves.optimized.png) Bifrost lets enterprise teams enforce Google Model Armor guardrails inline, blocking prompt injection and redacting sensitive data on every LLM request. Prompt injection is the top security risk for LLM applications in the OWASP Top 10 for LLM Applications, and sensitive information disclosure now ranks second. Bifrost, the open-source](https://www.getmaxim.ai/articles/google-model-armor-guardrails-with-bifrost/) [![Natural-Language Safety Rules with GraySwan in Bifrost](https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w720/2026/07/natural-language-safety-rules-with-grayswan-in-bifrost-bifrost-paper-waves.optimized.png) Bifrost integrates GraySwan Cygnal so teams can define natural-language safety rules in plain English, with violation scoring and prompt-injection detection. Prompt injection ranks as the number one security risk for large language model applications in the OWASP Top 10 for LLM Applications 2025. Most teams respond by writing](https://www.getmaxim.ai/articles/natural-language-safety-rules-with-grayswan-in-bifrost/) ```json { "@context": "https://schema.org", "@type": "Article", "publisher": { "@type": "Organization", "name": "Maxim Articles", "url": "https://www.getmaxim.ai/articles/", "logo": { "@type": "ImageObject", "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w256h256/2025/08/thumbnail.png", "width": 60, "height": 60 } }, "author": { "@type": "Person", "name": "Kuldeep Paul", "image": { "@type": "ImageObject", "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/2025/08/1727978381919.jpeg", "width": 800, "height": 800 }, "url": "https://www.getmaxim.ai/articles/author/kuldeep/", "sameAs": [] }, "headline": "Configuring Azure AI Content Safety in Bifrost", "url": "https://www.getmaxim.ai/articles/configuring-azure-ai-content-safety-in-bifrost/", "datePublished": "2026-06-02T04:43:00.000Z", "dateModified": "2026-10-13T11:02:41.000Z", "image": { "@type": "ImageObject", "url": "https://storage.ghost.io/c/84/03/8403f2f6-141c-411a-8f55-a32d4291533e/content/images/size/w1200/2026/07/configuring-azure-ai-content-safety-in-bifrost-bifrost-paper-waves.optimized.png", "width": 1200, "height": 630 }, "keywords": "AI Governance", "description": "Configure Azure AI Content Safety in Bifrost to enable Jailbreak Shield, Indirect Prompt Injection Shield, and severity-based content filtering at the gateway.\n\nPrompt injection ranks as the highest-priority security risk for LLM applications in the OWASP Top 10 for 2025, covering both direct attacks in user input and indirect attacks hidden in retrieved content. Enforcing content safety inside each application leaves gaps every time a new service ships with a different filter version, and polic", "mainEntityOfPage": "https://www.getmaxim.ai/articles/configuring-azure-ai-content-safety-in-bifrost/" } ```