Back to Details

defender-for-cloud-ai

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Microsoft Defender for Cloud — AI Workload Protection

Microsoft Defender for Cloud — AI工作负载保护

Defender for Cloud's AI plan protects the AI workloads themselves — the Azure OpenAI, Azure AI Foundry, Amazon Bedrock, and Google Vertex AI deployments your organization runs. Two capabilities:
  • AI Security Posture Management (AI-SPM): agentless discovery and posture (where AI is deployed, what grounding data is exposed, what misconfigurations exist).
  • Runtime threat protection for AI workloads: detections on Azure OpenAI for prompt injection, jailbreaks, sensitive-data leakage, wallet abuse, and credential leakage, integrating Azure AI Content Safety Prompt Shields.
Defender for Cloud的AI计划专门保护AI工作负载本身——即您组织运行的Azure OpenAI、Azure AI Foundry、Amazon Bedrock和Google Vertex AI部署。包含两项核心能力：
  • AI安全态势管理（AI-SPM）：无代理式发现与态势评估（AI部署位置、哪些基础数据暴露、存在哪些配置错误）。
  • AI工作负载运行时威胁防护：针对Azure OpenAI的检测能力，覆盖提示注入、越狱、敏感数据泄露、钱包滥用和凭证泄露，并集成Azure AI Content Safety Prompt Shields。

When to use

适用场景

You build or operate generative AI applications on Azure OpenAI / Azure AI Foundry (and optionally Bedrock/Vertex), and need posture + runtime detection on the workload side.
Do not use this skill for end-user-side AI governance (
purview-ai-hub
), Content Safety policy authoring (
azure-ai-content-safety
), or M365 Copilot rollout (
copilot-for-m365-readiness
).
您在Azure OpenAI / Azure AI Foundry（可选扩展至Bedrock/Vertex）上构建或运营生成式AI应用，需要针对工作负载侧的态势评估+运行时检测能力。
请勿将此技能用于终端用户侧AI治理（使用
purview-ai-hub
）、Content Safety策略编写（使用
azure-ai-content-safety
）或M365 Copilot部署（使用
copilot-for-m365-readiness
）。

What you get

您可获得的能力

CapabilityScope
Multicloud AI discoveryAzure (OpenAI, Foundry), AWS Bedrock, GCP Vertex AI (via existing multicloud connectors)
Sensitive grounding data exposureIdentifies grounding storage with sensitive data + public/over-permissive access
Attack path analysis"Internet-exposed AI endpoint with sensitive grounding + over-privileged identity"
Runtime detections (Azure OpenAI)Prompt injection, jailbreak, sensitive data leakage in prompts/responses, suspicious access patterns, wallet abuse
Prompt Shields integrationDetections leverage Content Safety prompt-shield signals
Alerts in Defender XDRCorrelated incidents alongside cloud and identity signals
能力覆盖范围
多云AI发现Azure（OpenAI、Foundry）、AWS Bedrock、GCP Vertex AI（通过现有多云连接器）
敏感基础数据暴露检测识别包含敏感数据且具有公共/过度宽松访问权限的基础存储
攻击路径分析检测“暴露于公网的AI端点+敏感基础数据+权限过高的身份”这类风险路径
运行时检测（Azure OpenAI）提示注入、越狱、提示/响应中的敏感数据泄露、可疑访问模式、钱包滥用
Prompt Shields集成检测能力可利用Content Safety的Prompt Shields信号
Defender XDR中的警报与云和身份信号关联的相关事件

Approach

实施步骤

  1. Prereqs. Defender for Cloud enabled at subscription scope. Defender CSPM plan on (provides AI-SPM via attack path analysis). Defender for AI Services runtime plan on for Azure OpenAI workloads. For non-Microsoft clouds, the AWS/GCP connector must already be in place.
  2. Discover AI assets. Within 24 hours of enablement, Defender for Cloud inventory shows Azure OpenAI, Foundry, Bedrock, and Vertex resources. Review the AI Security posture dashboard:
    • Which AI resources are public-network-exposed.
    • Which use Microsoft Entra (good) vs API key (warns).
    • Which grounding stores (Azure AI Search, Blob, Cosmos) contain sensitive data classified by Purview, and whether they're over-permissioned.
  3. Triage attack paths first. The high-value paths are typically:
    • Internet-exposed Azure OpenAI endpoint + grounding store with sensitive data + identity with broad RBAC.
    • Foundry hub with public networking + customer-managed grounding data + no Content Safety filter. Fix the path (private endpoint, scope identity, enable Content Safety) rather than triaging each finding in isolation.
  4. Enable runtime detection (Azure OpenAI). Single toggle per subscription. The service samples prompts/responses (subject to your data privacy configuration) and evaluates against Microsoft's threat models plus Prompt Shields.
  5. Wire Content Safety Prompt Shields in your application's Azure OpenAI call chain. Defender alerts gain higher fidelity when Prompt Shields are active because the workload itself has rejected the attempt — Defender now alerts the SOC.
  6. Alert response runbook.
    • Prompt injection / jailbreak detected: enrich with caller identity, source IP, repeat rate; if persistent, revoke API key / disable user.
    • Sensitive data leakage in response: investigate grounding data; tighten RBAC on grounding store; add Content Safety output filter.
    • Wallet abuse (high cost from a single principal): rate-limit, revoke, investigate compromised credential.
    • Credential leakage in prompt: rotate the leaked secret, hunt for prior exposure in logs.
  7. Defender XDR / Sentinel integration. Alerts surface under "Microsoft Defender for AI Services" / "Cloud" categories. Build cross-product correlations (e.g., AI alert + Defender for Cloud Apps anomalous user activity).
  8. Continuous posture review. Weekly: new AI deployments without private endpoint, new grounding stores with sensitive data, new identities with broad AI RBAC.
  1. 前置条件：已在订阅范围启用Defender for Cloud。为相关资源开启Defender CSPM计划（通过攻击路径分析提供AI-SPM能力）。为Azure OpenAI工作负载开启Defender for AI Services运行时计划。对于非微软云环境，需已配置AWS/GCP连接器。
  2. 发现AI资产：启用后24小时内，Defender for Cloud清单将显示Azure OpenAI、Foundry、Bedrock和Vertex资源。查看AI安全态势仪表盘：
    • 哪些AI资源暴露于公网。
    • 哪些使用Microsoft Entra认证（合规），哪些使用API密钥（预警）。
    • 哪些基础存储（Azure AI Search、Blob、Cosmos）包含经Purview分类的敏感数据，以及这些存储是否存在权限过度配置。
  3. 优先处理攻击路径：高价值风险路径通常包括：
    • 暴露于公网的Azure OpenAI端点+包含敏感数据的基础存储+拥有广泛RBAC权限的身份。
    • 启用公网访问的Foundry中心+客户管理的基础数据+未配置Content Safety过滤器。 修复整个风险路径（如配置私有端点、限制身份权限、启用Content Safety），而非孤立处理单个检测结果。
  4. 启用运行时检测（Azure OpenAI）：每个订阅只需一键开启。服务会对提示/响应进行采样（遵循您的数据隐私配置），并对照微软威胁模型及Prompt Shields进行评估。
  5. 在应用的Azure OpenAI调用链中接入Content Safety Prompt Shields：当Prompt Shields处于激活状态时，Defender警报的准确性会更高，因为工作负载本身已拦截攻击尝试——Defender会向SOC发出警报。
  6. 警报响应手册：
    • 检测到提示注入/越狱：补充调用者身份、源IP、重复频率等信息；若攻击持续，吊销API密钥/禁用用户。
    • 响应中存在敏感数据泄露：调查基础数据；收紧基础存储的RBAC权限；添加Content Safety输出过滤器。
    • 钱包滥用（单个主体产生高额成本）：设置速率限制、吊销权限、调查凭证是否泄露。
    • 提示中存在凭证泄露：轮换泄露的密钥，在日志中排查过往暴露情况。
  7. Defender XDR / Sentinel集成：警报将显示在“Microsoft Defender for AI Services”/“云”类别下。构建跨产品关联规则（例如，AI警报+Defender for Cloud Apps中的异常用户活动）。
  8. 持续态势审查：每周检查：未配置私有端点的新AI部署、包含敏感数据的新基础存储、拥有广泛AI RBAC权限的新身份。

Guardrails

防护准则

  • Runtime protection samples prompts/responses. Validate data privacy posture and customer-facing disclosures; in some regulated industries this requires customer consent.
  • Public endpoints are the dominant risk. AI services default to public unless you configure private endpoints; bake into landing-zone policy.
  • API key auth is the second dominant risk. Force Entra-based authentication; rotate any keys quarterly minimum.
  • Grounding data is the new database. Same crown-jewel treatment — sensitivity labels, RBAC scoping, Defender for Storage on the source.
  • Content Safety is separate from Defender. You need both: Content Safety blocks at the model call, Defender detects/alerts on the security incident.
  • Defender for AI does not protect against business-logic abuse of your AI app. That remains your application's responsibility (input validation, rate limits, auth).
  • Multicloud AI runtime detection is staged rollout. Verify what's GA vs preview for Bedrock/Vertex in your region.
  • 运行时防护会对提示/响应进行采样：验证数据隐私态势及面向客户的披露声明；部分受监管行业需获得客户同意。
  • 公网端点是主要风险源：AI服务默认公网访问，除非配置私有端点；需将私有端点配置纳入着陆区策略。
  • API密钥认证是第二大风险：强制使用Entra认证；至少每季度轮换一次密钥。
  • 基础数据等同于核心数据库：需给予同等的核心资产保护——设置敏感度标签、限定RBAC范围、为源存储启用Defender for Storage。
  • Content Safety与Defender相互独立：两者需配合使用：Content Safety在模型调用阶段拦截攻击，Defender检测并警报安全事件。
  • Defender for AI不防护AI应用的业务逻辑滥用：这仍是应用自身的责任（输入验证、速率限制、认证）。
  • 多云AI运行时检测处于分阶段推出状态：请确认您所在区域Bedrock/Vertex的功能是GA（正式可用）还是预览版。

Common anti-patterns

常见反模式

  • "AI workload deployed with public endpoint + API key for 'developer velocity'" — becomes a permanent attack surface and the #1 alert source.
  • "Grounding data store with sensitive data and 'Reader' to AAD-everyone'" — exposure surfaces in Copilot-of-your-app the same way M365 Copilot oversharing does.
  • "Enabled Content Safety Prompt Shields, skipped Defender for AI" — you reject attacks but don't see the campaign or correlate with identity.
  • "Enabled Defender for AI without Defender CSPM" — lose attack path analysis, alerts arrive without context.
  • "Treated wallet-abuse alerts as cost management problem only" — usually a compromised credential. Investigate as a security incident.
  • "Sentinel alert routing not configured" — alerts pile in DfC console, no SOC triage.
  • "API key 'temporarily' in code" — leaked credentials trigger detections, but you've already paid the cost.
  • “为了‘开发效率’，AI工作负载采用公网端点+API密钥部署”——会形成永久攻击面，成为头号警报来源。
  • “包含敏感数据的基础存储设置了‘AAD全员可读’权限”——暴露的风险会在您应用的Copilot中显现，与M365 Copilot过度共享数据的情况类似。
  • “启用了Content Safety Prompt Shields，但跳过了Defender for AI”——您拦截了攻击，但无法看到攻击活动或与身份关联分析。
  • “启用了Defender for AI，但未启用Defender CSPM”——失去攻击路径分析能力，警报缺乏上下文信息。
  • “仅将钱包滥用警报视为成本管理问题”——这通常意味着凭证泄露，需作为安全事件进行调查。
  • “未配置Sentinel警报路由”——警报堆积在DfC控制台，无法被SOC及时处理。
  • “API密钥‘临时’嵌入代码中”——凭证泄露会触发检测，但您已为此付出代价。

Example prompts

示例提示

  • Enable Defender for Cloud AI plan across 12 subscriptions with Azure OpenAI and AI Foundry deployments.
  • Inventory AI workloads and grounding stores; identify top-10 attack paths.
  • Build runbook for "Prompt injection detected" alerts: triage, containment, hunt.
  • Integrate Azure AI Content Safety Prompt Shields with our Foundry chat app and enable Defender runtime detection.
  • Posture pipeline: Azure Policy to require private endpoint + Entra auth on all Azure OpenAI resources.
  • Connect AWS Bedrock and GCP Vertex AI usage into Defender AI-SPM.
  • Sentinel detection correlating Defender AI wallet-abuse alert with sign-in risk on the calling identity.
  • 为12个包含Azure OpenAI和AI Foundry部署的订阅启用Defender for Cloud AI计划。
  • 盘点AI工作负载和基础存储，识别Top 10攻击路径。
  • 为“检测到提示注入”警报构建响应手册：分类、遏制、排查。
  • 将Azure AI Content Safety Prompt Shields与我们的Foundry聊天应用集成，并启用Defender运行时检测。
  • 态势管控 pipeline：使用Azure Policy要求所有Azure OpenAI资源必须配置私有端点+Entra认证。
  • 将AWS Bedrock和GCP Vertex AI使用情况接入Defender AI-SPM。
  • 构建Sentinel检测规则，关联Defender AI钱包滥用警报与调用身份的登录风险。

Microsoft Learn

Microsoft Learn参考文档