← Safety

Azure AI Content SafetyAzure AI Content Safety

Microsoft

云端Cloud 商业Commercial guardrailsguardrails APIAPI 多平台Multi-platform partial lifecycle: active 核验Checked 2026-11-06

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

未确认的信息Information not confirmed

中国大陆是否有运营方提供本服务（官方区域表与定价页均未在册）
内容安全分类模型的具体版本号（官方 FAQ 说明不做版本发布）
各能力在不同语言下的准确率
Embedded SDK 与 Multimodal 的替代迁移路径细节（只取到退役日期）
F0 免费额度的具体数值（本页不采价格与配额数字，见定价页）

Whether any operator offers this service in mainland China (the official region table and the pricing page say nothing)
Specific version numbers of the content-safety classification models (the FAQ states Microsoft does not version them)
Accuracy per language for each capability
Migration details for the Embedded SDK and Multimodal retirement (only the retirement date was on record)
The exact F0 free quota figure (this archive does not carry price or quota numbers; see the pricing page)

它是云上的内容判定接口，不替你决定怎么处理结果。

官方 FAQ 把这点写得很直白：API 返回的是分类元数据（严重度或二值结果），删除、打标、拦截这些执行动作由你自己的策略来做。

它是云上的内容判定接口，不替你决定怎么处理结果。

官方 FAQ 把这点写得很直白：API 返回的是分类元数据（严重度或二值结果），删除、打标、拦截这些执行动作由你自己的策略来做。

适合与不适合When to use it, when not to

适合已在 Azure 上跑模型、要文本与图像分级严重度加提示攻击检测、并要求区域驻留的团队。不适合两类需求：要长期离线跑护栏（容器已公告退役），要自己掌握 rail 逻辑与模型端点（那是本地库那条线）。想拿它做「谁更准」的横向排名也不合适——官方语言页明确建议你自己测。

中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-11-06

出品属地Origin: 国外出品foreign-made　Microsoft 主体；官方区域表按 Americas / Europe / Asia Pacific / Middle East & Africa 分组在册。Microsoft entity; the official region table is grouped as Americas / Europe / Asia Pacific / Middle East & Africa.
国内使用Direct access: 直连未核验direct unknown　同日实测 learn.microsoft.com 与 azure.microsoft.com 返回 200，但这只是文档可达；官方区域在册表未列中国大陆区域，定价页当日也未写中国区可用性。服务在大陆是否可用未核验到官方来源，不以「网页能打开」推断合规可用。Same-day probes returned 200 for learn.microsoft.com and azure.microsoft.com, but that is documentation reachability only; the official region table lists no mainland-China region and the pricing page said nothing about a China region. Service availability in the mainland is unverified — page reachability is not treated as compliant availability.
备案状态CAC filing: 备案未核验filing unknown：官方页面当日在册内容未提中国大陆备案/登记；本次未检索监管公示名单，不做推断。The pages fetched same day say nothing about mainland filing/registration; the public registry was not searched.

备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.

固定坐标系Fixed coordinate system

8 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.

模型与开放条件Model & openness: 它不给模型，只给护栏。官方 Foundry 护栏页在册：护栏用 Azure AI Content Safety 的分类模型，适用于所有「Azure 出售的 Foundry Models」（音频转写除外），agent 侧 tool call / tool response 为 preview。也可以完全脱离 Foundry，用独立 REST API 守任意平台的模型输出。
It supplies guardrails, not models. The Foundry guardrails page records that the controls use Azure AI Content Safety classification models and apply to every Foundry Model sold by Azure except audio transcription, with tool call / tool response intervention points in preview for agents. It can also run completely outside Foundry, guarding models on any platform through the standalone REST API.
运行位置Where it runs: 托管云 API + 网页工作台（contentsafety.cognitive.azure.com 在册）。检测在 Azure 侧执行。官方容器页在册 own-environment 选项只有 Analyze text / Analyze image / Prompt Shields，且 connected 与 disconnected 容器于 2027-04-30 退役，容器仍需回连 Azure 计量。
Hosted cloud API plus a web studio (contentsafety.cognitive.azure.com is on record). Detection executes on Azure's side. The official container page records only Analyze text, Analyze image and Prompt Shields for your own environment, retires connected and disconnected containers on 2027-04-30, and states containers must stay connected to Azure for metering.
本地文件Local files: 不读写你的工作区文件：内容通过 REST / SDK 提交，或在工作台里上传样本与数据集。数据页在册的唯一留存项是 blocklist：条目存 Azure Storage、同区域、微软托管密钥加密，可用 DELETE API 删。
It neither reads nor writes your workspace: content is submitted over REST / SDK, or uploaded as samples and datasets in the studio. The only retention item recorded on the data page is the blocklist - items live in Azure Storage, encrypted at rest with Microsoft-managed keys, in the same region as the resource, deletable through the DELETE API.
关机后的任务Tasks after shutdown: 同步请求—响应为主。官方 FAQ 在册「异步过滤」：过滤与流式返回并行、内容不缓冲，代价是「不安全内容可能在过滤完成前短暂露出」。这是延迟取舍，不是关机后续跑的托管任务。
Request-response is the main shape. The FAQ records asynchronous filtering: the filter runs in parallel with streaming, nothing is buffered, at the cost of 'unsafe content might be briefly exposed before filtering is complete'. That is a latency trade-off, not a task that survives your shutdown.
工具与扩展Tools & extensions: API 面在册：Analyze text、Analyze image、Multimodal（preview，2027-04-30 退役）、Prompt Shields、 Protected material（text / code）、Groundedness（preview，同期退役）、Custom categories（standard / rapid）、 Task Adherence、Blocklist。SDK 覆盖 C# / Python / Java / JavaScript；工作台可导出调用代码。
API surface on record: Analyze text, Analyze image, Multimodal (preview, retiring 2027-04-30), Prompt Shields, Protected material (text / code), Groundedness (preview, retiring the same date), Custom categories (standard / rapid), Task Adherence and Blocklist. SDKs cover C# / Python / Java / JavaScript, and the studio can export the calling code.
上下文与记忆Context & memory: 按单次请求判定，不做长上下文或记忆。官方 limits 页在册输入上限：文本 10K 字符、图像 4MB、Prompt Shields 10K 字符、groundedness 源 55K 字符、task adherence 100K 字符等。多轮与会话管理由调用方自己负责。
It judges one request at a time; there is no long context or memory. The limits page records input ceilings: 10K characters of text, 4 MB images, 10K characters for Prompt Shields, 55K characters of grounding sources, 100K characters for task adherence. Multi-turn handling belongs to the caller.
权限与限制Permissions & limits: 数据页在册三条硬陈述：检测时不存储输入文本与图像、不用客户数据训练或改进模型、 Azure OpenAI 的 Abuse Monitoring 不适用（内容不做人工复核）。区域页在册：数据留在你所选区域。鉴权支持 Microsoft Entra ID / 托管身份，支持 CMK / BYOK。档位 F0 / S0，F0 有月度免费额度（数字见定价页）。
Three hard statements are on the data page: inputs are not stored during detection, customer data is not used to train or improve the models, and Azure OpenAI Abuse Monitoring does not apply (no human review). The region page says data stays in the region you chose. Authentication supports Microsoft Entra ID and managed identity; CMK / BYOK is supported. Tiers are F0 and S0, with a monthly free quota on F0 (numbers live on the pricing page).
适合什么任务Best for: 适合已经把工作负载放在 Azure 上、要多模态分级严重度与提示攻击检测、并要求区域驻留与「不训练」承诺的团队。不适合需要离线长期跑护栏的场景（容器即将退役），也不适合要自己掌握 rail 代码与模型端点的团队——那类需求看本地线。
Fits: teams already running workloads on Azure that need graded severity across text and images plus prompt-attack detection, and that want region residency and a no-training commitment on record. Not a fit: long-term offline filtering (the containers are being retired) or teams that want to own the rail code and the model endpoint - that is the local-library line.

头号误解Top misconception

把容器当长期离线方案：官方页在册 connected / disconnected 容器 2027-04-30 退役
把「异步过滤」当成零暴露：官方 FAQ 写明不安全内容可能在过滤完成前短暂露出
以为多语言同等可靠：官方在册部分能力仅以英文训练评估，中文只在部分分类器的训练测试语言里

证据来源Evidence sources

最近核验记录Latest recorded check 2026-11-06，内容更新日content updated on 2026-11-06。单项复核范围见正文或来源说明，不代表所有字段在同一天重新核验。See the text or source notes for item-specific scope; this does not mean every field was rechecked on that date.

类型Type	名称Name	链接Link
docs	Azure AI Content Safety · 产品页（定位与能力条目，2026-11-06 直抓 200）Azure AI Content Safety · product page (positioning and capability entries, direct-fetched 200 on 2026-11-06)	https://azure.microsoft.com/en-us/products/ai-services/ai-content-safety
docs	Azure AI Content Safety · Overview（能力清单、Studio、限流、档位、退役公告，2026-11-06 直抓 200）Azure AI Content Safety · Overview (capability list, Studio, rate limits, tiers, retirement notice, direct-fetched 200 on 2026-11-06)	https://learn.microsoft.com/en-us/azure/ai-services/content-safety/overview
docs	Azure AI Content Safety · Region availability（逐区域可用性表与输入/语言限制，2026-11-06 直抓 200）Azure AI Content Safety · Region availability (per-region table plus input and language limits, direct-fetched 200 on 2026-11-06)	https://learn.microsoft.com/en-us/azure/ai-services/content-safety/region-availability
docs	Azure AI Content Safety · FAQ（数据留存与训练用途、异步过滤、严重度阈值建议，2026-11-06 直抓 200）Azure AI Content Safety · FAQ (retention and training use, asynchronous filtering, severity-threshold advice, direct-fetched 200 on 2026-11-06)	https://learn.microsoft.com/en-us/azure/ai-services/content-safety/faq
docs	Azure AI Content Safety · Data, privacy, and security（不存储、不训练、区域驻留、blocklist 存储，2026-11-06 直抓 200）Azure AI Content Safety · Data, privacy, and security (no storage, no training, region residency, blocklist storage, direct-fetched 200 on 2026-11-06)	https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/content-safety/data-privacy
docs	Azure AI Content Safety · Foundry guardrails overview（干预点、默认护栏、阻断档位与适用范围，2026-11-06 直抓 200）Azure AI Content Safety · Foundry guardrails overview (intervention points, default guardrail, blocking levels, applicability, direct-fetched 200 on 2026-11-06)	https://learn.microsoft.com/en-us/azure/ai-foundry/guardrails/guardrails-overview
migration	Azure AI Content Safety · Containers overview（本机容器范围与 2027-04-30 退役，2026-11-06 直抓 200）Azure AI Content Safety · Containers overview (on-prem scope and the 2027-04-30 retirement, direct-fetched 200 on 2026-11-06)	https://learn.microsoft.com/en-us/azure/ai-services/content-safety/how-to/containers/container-overview
changelog	Azure AI Content Safety · What's new（2026-10 模型更新与分阶段上线、退役清单，2026-11-06 直抓 200）Azure AI Content Safety · What's new (October 2026 model update, staged rollout, retirement list, direct-fetched 200 on 2026-11-06)	https://learn.microsoft.com/en-us/azure/ai-services/content-safety/whats-new
pricing	Azure AI Content Safety · Pricing（档位结构与计费单元，本页不采价格数字，2026-11-06 直抓 200）Azure AI Content Safety · Pricing (tier structure and billing unit; no price numbers in this archive, direct-fetched 200 on 2026-11-06)	https://azure.microsoft.com/en-us/pricing/details/content-safety/

官方口径与未核到项Official record and unverified items

本站尚未完成实测。本档不含拦截率、误报率或延迟数字；官方也要求逐语言自测。

实测建议（三条）：

中文与英文样本在同一档位下的严重度分布差异（官方在册分类器训练测试语言含中文）
异步过滤的实际露出窗口有多长（FAQ 在册该取舍）
agent 护栏覆盖模型护栏后，工具调用与响应是否真的未被扫描

This site has not completed measured runs; nothing here covers block rates, false-positive rates or latency, and the vendor itself asks customers to test per language.

Suggested measurements (three):

Severity distributions for Chinese versus English samples at the same blocking level
How long the exposure window really is under asynchronous filtering (the FAQ records the trade-off)
Whether tool calls and tool responses really go unscanned once an agent guardrail overrides the model guardrail

能力边界Capability boundaries

在册的判定对象有四类干预点：用户输入、工具调用（preview）、工具响应（preview）、输出。 Foundry 侧模型默认挂 Microsoft.DefaultV2；输出侧的内容危害关掉需要走审批表单，输入侧人人可关。agent 护栏会整体覆盖模型护栏，官方页给了示例说明这种覆盖的实际后果。另有一条硬边界写在 Overview：本服务不得用于检测非法儿童性虐待图像。

Four intervention points are recorded: user input, tool call (preview), tool response (preview) and output. On the Foundry side models get Microsoft.DefaultV2 by default; turning content harms off for inputs is available to everyone, while turning them off for outputs requires an approved customer form. An agent guardrail fully overrides the model guardrail, and the official page walks through what that means for tool calls and responses. One hard boundary sits in the Overview: the service must not be used to detect illegal child-exploitation images.

变更记录说明Change record

变更记录走官方 What's new 页（无独立 releases 页）。当日在册要点： 2026-10 文本内容危害分类与 Prompt Shields（UPIA / XPIA）模型更新，先在 Spain Central 灰度、分阶段扩展，并明确「不改动 PII、task adherence、blocklist、protected material 与图像能力」；同期公告 2027-04-30 退役 Multimodal、Custom categories（rapid）、connected / disconnected 容器、 Embedded SDK 与 Groundedness detection。更早的 GA / preview 节奏可回溯到 2023-05 公开预览。

Change history lives on the official What's new page (there is no separate releases page). Recorded on the verification day: the October 2026 update to text harm classification and Prompt Shields (UPIA / XPIA), rolled out first in Spain Central in stages, explicitly not changing PII, task adherence, blocklists, protected material or image capabilities; and the announced 2027-04-30 retirement of Multimodal, Custom categories (rapid), connected / disconnected containers, the Embedded SDK and Groundedness detection. Earlier GA and preview cadence traces back to the May 2023 public preview.