Azure AI Content Safety

About Azure AI Content Safety

Azure AI Content Safety is a managed Azure service for detecting and classifying harmful user-generated and AI-generated content. It provides APIs for text and image moderation, prompt-attack detection, protected-material detection, groundedness checks and custom safety categories, with some capabilities still in preview. The service is designed for teams that need moderation controls they can call from applications rather than building and maintaining their own safety models. It fits marketplaces, social and gaming products, education platforms, media services and generative AI applications where content needs to be screened before it is shown, stored or acted on.

What does Azure AI Content Safety detect?

The core text and image analysis APIs classify content across Microsoft's documented harm categories for sexual content, violence, hate and self-harm, and return severity levels that applications can use in policy decisions. Teams can combine those classifications with blocklists and their own moderation rules instead of treating a model score as the final business decision.

Microsoft also documents AI-focused controls. Prompt Shields scans text for user input attacks against large language models. Protected material detection checks generated text or code for known protected material. Groundedness detection, currently documented as preview, can test whether an LLM answer is supported by supplied source material. Task adherence, also documented in the current service overview, is aimed at detecting tool use by AI agents that is misaligned, unintended or premature.

How do teams integrate the service?

Developers can call Azure AI Content Safety through REST APIs and supported SDKs. Microsoft also provides a browser-based try-it-out experience in Foundry Guardrails and controls where teams can test sample content, adjust severity thresholds and export sample code. This is useful for calibrating a policy before wiring it into production.

A typical integration sends text or an image to the relevant API, receives category and severity results, and then applies application-specific rules such as allow, review, redact or block. For generative AI applications, moderation can be placed around both user prompts and model outputs. Microsoft recommends protecting keys and endpoints rather than embedding credentials in application code.

What are the current service limits?

Microsoft's current overview lists a default maximum of 10,000 characters for the Analyze Text API. Analyze Image accepts files up to 4 MB with dimensions from 50 by 50 through 7200 by 7200 pixels in supported image formats. The preview multimodal API currently allows up to 1,000 text characters with an image, while Prompt Shields supports prompts up to 10,000 characters and up to five documents totaling 10,000 characters.

Rate limits differ by pricing tier and capability. Microsoft currently lists 5 requests per second for the F0 tier across several moderation features. For S0, the current table lists 1,000 requests per 10 seconds for text and image moderation, Prompt Shields and protected-material detection, with different limits for some preview capabilities. Buyers planning high-volume moderation should confirm the current regional quota before launch.

Which languages and regions are supported?

Microsoft states that protected-material detection, groundedness detection and custom categories standard currently work with English only. Other Content Safety models have been specifically trained and tested for Chinese, English, French, German, Spanish, Italian, Japanese and Portuguese, while Microsoft notes that quality in other languages can vary and should be tested for the application's own content.

Feature availability also varies by Azure region. A region that supports text moderation may not expose every preview feature. That matters for organizations with data-residency requirements or strict deployment-region policies, so region selection should be validated against the exact APIs the application needs rather than assuming every Content Safety feature is globally uniform.

How does Azure AI Content Safety pricing work?

Pricing checked: August 28, 2026. Microsoft currently offers F0 and S0 tiers. The pricing page lists 5,000 text records per month and 5,000 images per month for the Free web tier. In the Standard tier, text is billed by submitted text records and images by submitted image count, with regional and agreement-specific rates shown through Azure pricing tools rather than one universal price.

For Standard billing, Microsoft defines one text record as up to 1,000 Unicode characters. A 7,500-character input therefore counts as eight text records, while a 500-character input counts as one. The free tier stops processing after its included transaction limit is reached instead of accruing overage. Buyers should model cost from actual content length and image volume, not just API-call count.

What security and governance controls are available?

Microsoft documents support for Microsoft Entra ID and managed identities. A managed identity is automatically enabled when a Content Safety resource is created, and Entra ID can be used for API and SDK authentication. Azure role-based access control can then limit who can use or manage the resource.

For data-at-rest protection, Microsoft documents encryption and support for customer-managed keys, giving organizations more control over key creation, rotation and revocation. These platform controls are useful, but they do not replace application governance. Teams still need to decide who can change thresholds, how moderation decisions are logged, which cases require human review and how appeals or false positives are handled.

What are the main limitations and migration considerations?

Azure AI Content Safety is a classification and safety-control service, not a complete trust-and-safety operation. It does not replace policy design, human escalation, abuse investigations or legal review. Microsoft also explicitly states that the service cannot be used to detect illegal child exploitation images, so organizations with that requirement need an appropriate specialist process and technology.

Some capabilities remain in preview, and Microsoft documents an API lifecycle policy under which previous preview or GA versions can be deprecated after newer versions arrive. Teams should therefore pin supported API versions intentionally and watch Microsoft's What's new and deprecation notices before production upgrades. Language coverage, regional availability and model behavior should also be tested against the application's real traffic rather than assumed from demos.

How does it differ from built-in AI filters and other Azure services?

Azure AI Content Safety is useful when an application needs a callable moderation service for its own text, images or AI workflows. It should not be confused with general Azure security services such as Microsoft Defender for Cloud, which focuses on cloud security posture and workload protection, or with Azure Web Application Firewall products that inspect network and HTTP traffic rather than semantic content.

It also differs from model-specific built-in safety layers. A team may still choose a standalone Content Safety integration when it needs moderation across multiple models, user-generated content, marketplaces or non-LLM workflows, or when it wants to apply a common moderation policy outside a single model endpoint.

Who should choose something else?

Choose something else if the requirement is primarily network security, malware protection, identity security or cloud-posture management rather than semantic moderation. A general Azure security product will be better aligned with those problems. Teams that need a full human moderation workforce, case-management platform or specialized illegal-content detection should also evaluate dedicated trust-and-safety tooling instead of assuming this API covers the entire operating process.

A small application with little or no user-generated content may not need a separate moderation service at all. Conversely, a high-risk platform should not rely on one automated classifier as its only control. The strongest fit is an application that has a clear moderation policy, measurable text or image volume, developers able to integrate APIs, and a plan for handling uncertain or escalated cases.