Microsoft Azure AI Foundry: Responsible AI policy tampering

Microsoft Azure AI Services (Foundry) utilizes Responsible AI (RAI) policies to regulate prompt and completion categories, identify jailbreak attempts, and block protected material. These guardrails are configured via RAI policies (Microsoft.CognitiveServices/accounts/raiPolicies) and term-level blocklists (raiBlocklists). An adversary with sufficient administrative privileges can modify or delete these configurations to neutralize safety guardrails. Such actions prevent the platform from blocking or logging harmful model interactions, thereby removing critical visibility into adversarial usage of AI deployments.

Impact

Successful manipulation of RAI policies disables security controls over AI model inputs and outputs. This allows for the execution of harmful prompts, injection of malicious payloads, and data exfiltration through AI models without triggering platform-native alerts or blocks.

Recommendation

• Monitor Azure Activity Logs for administrative write or delete operations against RAI policies and custom blocklists.
• Establish a principle of least privilege by restricting Microsoft.CognitiveServices/accounts/raiPolicies/* permissions to a highly limited group of authorized administrators.
• Integrate Azure Activity Logs into your SIEM/XDR platform to alert on modifications to the Cognitive Services control plane.
• Audit existing RAI policy configurations and verify that any observed modifications align with approved change management records.