What is Azure AI Content Safety?
Azure AI Content Safety is a set of screening APIs from Microsoft that you call before and after a model. The core checks score text and images for hate, sexual content, violence and self-harm at several severity levels. Prompt Shields look for attempts to override your instructions, both in the user's message and in up to five documents such as emails or web pages. Further checks spot copyrighted text such as lyrics and articles in model output, test whether an answer is grounded in its sources, and flag agent tool calls that do not match what the user asked for.
The same service powers the guardrails inside Microsoft Foundry, where it is switched on per model or agent deployment; the standalone API works with models hosted anywhere. Content Safety Studio is a web console for trying settings, managing blocklists and watching block rates.
The free F0 tier gives 5,000 text records and 5,000 images a month. On the standard tier a text record (up to 1,000 characters) costs $0.375 per 1,000 and an image $0.75 per 1,000 in East US. Several preview features, including groundedness detection and the containers, retire on 30 April 2027.
How much does Azure AI Content Safety cost?
| Plan | Price | What you get |
|---|---|---|
| Free (F0) | Free | 5,000 text records and 5,000 images a month; 5 requests per second |
| Standard (S0) | $0.375 per 1,000 text records | $0.75 per 1,000 images; 1,000 requests per 10 seconds |
| Commitment tier | $338/month | 1M text records a month, hosted on Azure |
Free F0 tier: 5,000 text records and 5,000 images a month. Standard: $0.375 per 1,000 text records (1,000 characters each) and $0.75 per 1,000 images (East US). Commitment tiers from $338/month for 1M text records.
Is Azure AI Content Safety worth it?
If your company already runs on Azure, adding a hosted AI guardrail usually means a new vendor review, a new contract and a new data processor. Content Safety skips most of that, because it is just another Azure resource with the same keys, roles and region choices you already use.
It does the jobs most chatbots need. It scores text and images for four kinds of harm, catches attempts to talk the model out of its instructions, and checks retrieved documents for hidden commands before your model reads them. Each check answers your app; nothing is blocked unless you decide it should be.
The price is low and published. A text record is up to 1,000 characters and costs $0.375 per 1,000 on the standard tier, so screening a million short messages costs $375. The free tier stops at 5,000 records a month and never bills overage.
The data terms are unusually plain. Microsoft says inputs are not stored, are not used to train its models and are not seen by its staff, and data stays in the region you pick, except for features Microsoft routes globally or by data zone. Only your blocklists are kept.
The catch: limits are tight and much of the service is still preview. Prompt Shields take 10,000 characters for the prompt and 10,000 across at most five documents, so long retrieved pages need splitting. Prompt Shields, grounding and copyright checks are trained mainly on English. Groundedness detection, multimodal analysis, rapid custom categories and the containers retire on 30 April 2027, and preview API versions are deprecated 90 days after a new one ships.
Our take: for an Azure shop this is the first layer to add, the way you would reach for the lock already fitted to your door before buying a new one. Teams outside Azure, or serving many languages, will find Google's Model Armor or an open model such as Qwen3Guard a better fit.
Where it earns its place
A developer at a 300-person insurer adding a claims chatbot on Azure OpenAI
Stop customers talking the bot out of its rules, and keep replies clean
Turn on Foundry guardrails for the deployment, with user prompt attack detection on by default and document attack detection switched on for retrieved policy text. Start in annotate mode to measure false positives before blocking.
An engineer running agents on AWS or Google Cloud under a Microsoft-only security policy
Screen tool outputs and emails for hidden instructions before the agent reads them
Call the standalone Prompt Shields API with the user prompt and up to five documents, each batch within 10,000 characters, and drop documents that come back with attackDetected.
A K-12 education software company moderating student uploads
Filter text and images for sexual, violent, hateful and self-harm content
Send text and images to the analyse APIs and block above your chosen severity. A million text records a month costs $375 on standard, or $338 on a commitment tier.
Before you commit
- Setup
- Create a Content Safety resource in a supported region, take the key or use managed identity, and call the REST API or SDK; the Studio lets you try thresholds on sample data first.
- Integrations
- REST API and SDKs; built into Microsoft Foundry guardrails for model and agent deployments; Content Safety Studio for blocklists, testing and monitoring; connected and disconnected containers in preview.
- Data and privacy
- Microsoft says inputs are not stored, not used to train or improve its models and not available for human review; data stays in the chosen region, though some features need global or data-zone routing. Blocklists are stored encrypted in your region. Customer-managed keys are supported.
- Cost at scale
- $0.375 per 1,000 text records and $0.75 per 1,000 images on standard in East US; a text record is 1,000 characters, so 7,500 characters bills as 8. Commitment tiers start at $338/month for 1M text records.
- Limits
- S0 allows 1,000 requests per 10 seconds for moderation and Prompt Shields, 50 per second for groundedness; text analysis caps at 10,000 characters and images at 4 MB; it cannot be used to detect child sexual abuse imagery.
What’s good
- Published prices: $0.375 per 1,000 text records on standard
- Prompt Shields check documents as well as user prompts
- Inputs not stored or used for training; regional processing for most checks
- Entra ID, managed identity and customer-managed keys
What’s not
- 10,000-character cap on Prompt Shields prompts and documents
- Prompt Shields, grounding and copyright checks mainly trained on English
- Several preview features retire on 30 April 2027
- Free tier limited to 5 requests per second
Best for
Teams already on Azure that want hosted moderation and prompt-injection screening for chatbots and agents without adding a vendor.
Azure AI Content Safety alternatives
Azure AI Content Safety: common questions
- Is Azure AI Content Safety worth it?
- Cheap, well-documented screening from a vendor your security team has already approved, with plainer data promises than most hosted guards, but outside English you are on your own. We rate it 4.1 out of 5.
- How much does Azure AI Content Safety cost?
- Free F0 tier: 5,000 text records and 5,000 images a month. Standard: $0.375 per 1,000 text records (1,000 characters each) and $0.75 per 1,000 images (East US). Commitment tiers from $338/month for 1M text records.
- What are the downsides of Azure AI Content Safety?
- 10,000-character cap on Prompt Shields prompts and documents; prompt Shields, grounding and copyright checks mainly trained on English; several preview features retire on 30 April 2027; free tier limited to 5 requests per second.
- Who is Azure AI Content Safety best for?
- Teams already on Azure that want hosted moderation and prompt-injection screening for chatbots and agents without adding a vendor.
- How much does Azure AI Content Safety cost for a team or in production?
- $0.375 per 1,000 text records and $0.75 per 1,000 images on standard in East US; a text record is 1,000 characters, so 7,500 characters bills as 8. Commitment tiers start at $338/month for 1M text records.
- Is Azure AI Content Safety safe for company data?
- Microsoft says inputs are not stored, not used to train or improve its models and not available for human review; data stays in the chosen region, though some features need global or data-zone routing. Blocklists are stored encrypted in your region. Customer-managed keys are supported.
- What are the best Azure AI Content Safety alternatives?
- The closest alternatives we have reviewed are Google Model Armor, Lakera Guard (Check Point AI Guardrails) and Amazon Bedrock.
Answers checked Nov 6, 2026.
Make Azure AI Content Safety? Show this rating on your site
