🛡️ Azure Subscription Microsoft Defender AI prompt evidence is not enabled🟢

• Contextual name: 🛡️ Subscription Microsoft Defender AI prompt evidence is not enabled🟢
• ID: /ce/ca/azure/subscription/microsoft-defender-ai-prompt-evidence
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Subscription
  • 🔌 Azure Defender Plan - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Microsoft Defender for AI Services alerts either include the suspicious segments of user prompts and model responses as evidence, with sensitive data redacted, or mask that content. The Enable user prompt evidence setting of the plan's suspicious prompt evidence component selects between them, with values On and Off. Prerequisites: Complete the recommendation Ensure That Microsoft Defender for AI Services Is Set To 'On' first, because this component can be configured only while the plan is on.

Rationale

With the component off, Defender for Cloud still detects AI threats but masks prompt and response content in alerts, so analysts cannot see what was sent to the model or what it returned. A jailbreak or data-leakage alert then cannot be confirmed or scoped from its evidence, delaying response and obscuring what data was disclosed.

Audit

This policy marks an Azure Subscription as INCOMPLIANT if no current AI Defender plan satisfies Standard pricing with the AIPromptEvidence extension set to the API value True.

... see more

Remediation

Open File

Remediation

Enable user prompt evidence for Microsoft Defender for AI Services on the affected subscription. The AI plan must use the Standard pricing tier, with the AIPromptEvidence extension enabled.

Review your organization's data-handling requirements and access to security alerts before enabling prompt evidence. Alerts can contain redacted snippets of user prompts and model responses, visible to alert readers and connected integrations.

Confirm that Microsoft Defender for AI Services is enabled by following Microsoft Defender for AI remediation. Review the plan's pricing before enabling Standard tier, and record its current settings before making changes. Use an account with permission to manage Defender plans on the affected subscription.

From Azure Portal

1. Go to Microsoft Defender for Cloud.
2. Under Management, select Environment settings.
3. Select the affected subscription and open Defender plans.
4. Locate AI services, confirm that Status is On, and select Settings.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 8.1.10.2 Ensure that 'Suspicious prompt evidence' Component Status is Set to 'On' (Automated)			1		no data
💼 Cloudaware Framework → 💼 Microsoft Defender Configuration			31		no data