-
Detects a Microsoft Foundry chat, sent through API Management, where Azure sets jailbreak.detected on the prompt. The flag is on the prompt filter when the call is allowed through, and on the error body when the filter blocks the call.
Read More -
Detects a Microsoft Foundry chat, sent through API Management, whose prompt or assistant reply contains a known credential pattern or an email address together with a password assignment. The model often refuses the request and Azure content filters stay clear, so the secret is only visible in the logged message text.
Read More -
Detects three or more completed assistant refusals from the same client, API Management subscription, and model. Matching replies finished on their own (finish_reason stop) and declined the prompt. A burst means that caller kept sending prompts the model will not answer.
Read More -
Microsoft Foundry Subscription Key Impossible Travel
Oct 5, 2026 · Data Source: Microsoft Foundry Use Case: Threat Detection Mitre Atlas: AML.T0091 Mitre Atlas: AML.T0012 Resources: Investigation Guide Tactic: Credential Access Tactic: Initial Access Rule Type: ES|QL Platform: Azure Domain: Cloud Domain: GenAI Service: Azure API Management Threat: Impossible Travel ·Detects the same API Management subscription key calling Microsoft Foundry from source IPs in two or more countries, far enough apart and fast enough that the hop is not physical travel. Calls are grouped by apim_subscription_id. Requests with no subscription key are ignored, because those are unauthenticated calls and share no key.
Read More