# Defender For Cloud Ai

> Guidance for Microsoft Defender for Cloud — AI workload protection (AI-SPM and runtime threat detection for generative AI). Covers AI Security Posture Management (discovery of Azure OpenAI / Azure AI Foundry / Amazon Bedrock / Google Vertex AI resources, identification of grounding data exposure, model deployment posture), runtime threat detection on Azure OpenAI (prompt injection / jailbreak att…

- **Type:** Skill
- **Install:** `agentstack add skill-vinayaklatthe-microsoft-security-skills-defender-for-cloud-ai`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [vinayaklatthe](https://agentstack.voostack.com/s/vinayaklatthe)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [vinayaklatthe](https://github.com/vinayaklatthe)
- **Source:** https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/defender-for-cloud-ai

## Install

```sh
agentstack add skill-vinayaklatthe-microsoft-security-skills-defender-for-cloud-ai
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Microsoft Defender for Cloud — AI Workload Protection

Defender for Cloud's AI plan protects the **AI workloads themselves** — the Azure OpenAI,
Azure AI Foundry, Amazon Bedrock, and Google Vertex AI deployments your organization runs.
Two capabilities:

- **AI Security Posture Management (AI-SPM)**: agentless discovery and posture (where AI
  is deployed, what grounding data is exposed, what misconfigurations exist).
- **Runtime threat protection for AI workloads**: detections on Azure OpenAI for prompt
  injection, jailbreaks, sensitive-data leakage, wallet abuse, and credential leakage,
  integrating Azure AI Content Safety **Prompt Shields**.

## When to use
You build or operate generative AI applications on Azure OpenAI / Azure AI Foundry (and
optionally Bedrock/Vertex), and need posture + runtime detection on the workload side.

**Do not use this skill** for end-user-side AI governance (`purview-ai-hub`), Content
Safety policy authoring (`azure-ai-content-safety`), or M365 Copilot rollout
(`copilot-for-m365-readiness`).

## What you get

| Capability | Scope |
|---|---|
| Multicloud AI discovery | Azure (OpenAI, Foundry), AWS Bedrock, GCP Vertex AI (via existing multicloud connectors) |
| Sensitive grounding data exposure | Identifies grounding storage with sensitive data + public/over-permissive access |
| Attack path analysis | "Internet-exposed AI endpoint with sensitive grounding + over-privileged identity" |
| Runtime detections (Azure OpenAI) | Prompt injection, jailbreak, sensitive data leakage in prompts/responses, suspicious access patterns, wallet abuse |
| Prompt Shields integration | Detections leverage Content Safety prompt-shield signals |
| Alerts in Defender XDR | Correlated incidents alongside cloud and identity signals |

## Approach

1. **Prereqs.** Defender for Cloud enabled at subscription scope. **Defender CSPM**
   plan on (provides AI-SPM via attack path analysis). **Defender for AI Services**
   runtime plan on for Azure OpenAI workloads. For non-Microsoft clouds, the AWS/GCP
   connector must already be in place.

2. **Discover AI assets.** Within 24 hours of enablement, Defender for Cloud inventory
   shows Azure OpenAI, Foundry, Bedrock, and Vertex resources. Review the **AI Security
   posture** dashboard:
   - Which AI resources are public-network-exposed.
   - Which use Microsoft Entra (good) vs API key (warns).
   - Which grounding stores (Azure AI Search, Blob, Cosmos) contain sensitive data
     classified by Purview, and whether they're over-permissioned.

3. **Triage attack paths first.** The high-value paths are typically:
   - *Internet-exposed Azure OpenAI endpoint + grounding store with sensitive data +
     identity with broad RBAC.*
   - *Foundry hub with public networking + customer-managed grounding data + no Content
     Safety filter.*
   Fix the path (private endpoint, scope identity, enable Content Safety) rather than
   triaging each finding in isolation.

4. **Enable runtime detection (Azure OpenAI).** Single toggle per subscription. The
   service samples prompts/responses (subject to your data privacy configuration) and
   evaluates against Microsoft's threat models plus Prompt Shields.

5. **Wire Content Safety Prompt Shields** in your application's Azure OpenAI call
   chain. Defender alerts gain higher fidelity when Prompt Shields are active because
   the workload itself has rejected the attempt — Defender now alerts the SOC.

6. **Alert response runbook.**
   - **Prompt injection / jailbreak detected**: enrich with caller identity, source
     IP, repeat rate; if persistent, revoke API key / disable user.
   - **Sensitive data leakage in response**: investigate grounding data; tighten
     RBAC on grounding store; add Content Safety output filter.
   - **Wallet abuse** (high cost from a single principal): rate-limit, revoke,
     investigate compromised credential.
   - **Credential leakage in prompt**: rotate the leaked secret, hunt for prior
     exposure in logs.

7. **Defender XDR / Sentinel integration.** Alerts surface under "Microsoft Defender
   for AI Services" / "Cloud" categories. Build cross-product correlations
   (e.g., AI alert + Defender for Cloud Apps anomalous user activity).

8. **Continuous posture review.** Weekly: new AI deployments without private endpoint,
   new grounding stores with sensitive data, new identities with broad AI RBAC.

## Guardrails
- **Runtime protection samples prompts/responses.** Validate data privacy posture and
  customer-facing disclosures; in some regulated industries this requires customer
  consent.
- **Public endpoints are the dominant risk.** AI services default to public unless you
  configure private endpoints; bake into landing-zone policy.
- **API key auth is the second dominant risk.** Force Entra-based authentication; rotate
  any keys quarterly minimum.
- **Grounding data is the new database.** Same crown-jewel treatment — sensitivity
  labels, RBAC scoping, Defender for Storage on the source.
- **Content Safety is separate from Defender.** You need both: Content Safety blocks at
  the model call, Defender detects/alerts on the security incident.
- **Defender for AI does not protect against business-logic abuse of your AI app.** That
  remains your application's responsibility (input validation, rate limits, auth).
- **Multicloud AI runtime detection is staged rollout.** Verify what's GA vs preview for
  Bedrock/Vertex in your region.

## Common anti-patterns
- **"AI workload deployed with public endpoint + API key for 'developer velocity'"** —
  becomes a permanent attack surface and the #1 alert source.
- **"Grounding data store with sensitive data and 'Reader' to AAD-everyone'"** —
  exposure surfaces in Copilot-of-your-app the same way M365 Copilot oversharing
  does.
- **"Enabled Content Safety Prompt Shields, skipped Defender for AI"** — you reject
  attacks but don't see the campaign or correlate with identity.
- **"Enabled Defender for AI without Defender CSPM"** — lose attack path analysis,
  alerts arrive without context.
- **"Treated wallet-abuse alerts as cost management problem only"** — usually a
  compromised credential. Investigate as a security incident.
- **"Sentinel alert routing not configured"** — alerts pile in DfC console, no SOC
  triage.
- **"API key 'temporarily' in code"** — leaked credentials trigger detections, but
  you've already paid the cost.

## Example prompts
- `Enable Defender for Cloud AI plan across 12 subscriptions with Azure OpenAI and AI
  Foundry deployments.`
- `Inventory AI workloads and grounding stores; identify top-10 attack paths.`
- `Build runbook for "Prompt injection detected" alerts: triage, containment, hunt.`
- `Integrate Azure AI Content Safety Prompt Shields with our Foundry chat app and
  enable Defender runtime detection.`
- `Posture pipeline: Azure Policy to require private endpoint + Entra auth on all
  Azure OpenAI resources.`
- `Connect AWS Bedrock and GCP Vertex AI usage into Defender AI-SPM.`
- `Sentinel detection correlating Defender AI wallet-abuse alert with sign-in risk on
  the calling identity.`

## Microsoft Learn
- AI plan overview: https://learn.microsoft.com/azure/defender-for-cloud/ai-threat-protection
- AI-SPM: https://learn.microsoft.com/azure/defender-for-cloud/ai-security-posture
- Enable threat protection for AI: https://learn.microsoft.com/azure/defender-for-cloud/ai-threat-protection
- Alerts reference (AI): https://learn.microsoft.com/azure/defender-for-cloud/alerts-reference#alerts-ai
- Attack path: https://learn.microsoft.com/azure/defender-for-cloud/concept-attack-path
- Azure AI Content Safety Prompt Shields: https://learn.microsoft.com/azure/ai-services/content-safety/concepts/jailbreak-detection
- Azure OpenAI Entra auth: https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity
- Multicloud connectors: https://learn.microsoft.com/azure/defender-for-cloud/multicloud

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [vinayaklatthe](https://github.com/vinayaklatthe)
- **Source:** [vinayaklatthe/microsoft-security-skills](https://github.com/vinayaklatthe/microsoft-security-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-vinayaklatthe-microsoft-security-skills-defender-for-cloud-ai
- Seller: https://agentstack.voostack.com/s/vinayaklatthe
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.