---
title: Azure AI Foundry Responsible AI (content filter) policy deleted
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure AI Foundry Responsible AI
  (content filter) policy deleted
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure AI Foundry Responsible AI (content filter) policy deleted
Classification:attackTactic:[TA0005-defense-evasion](https://attack.mitre.org/tactics/TA0005)Technique:[T1562-impair-defenses](https://attack.mitre.org/techniques/T1562) 
## Goal{% #goal %}

Detects deletion of an Azure AI Foundry Responsible AI (RAI) content-filter policy.

## Strategy{% #strategy %}

This rule monitors Azure Activity Log events where `@evt.name` is `MICROSOFT.COGNITIVESERVICES/ACCOUNTS/RAIPOLICIES/DELETE`. RAI policies define the content-filtering guardrails (blocked categories, prompt injection protection) applied to an Azure AI Foundry / Cognitive Services model deployment. Attackers often disable or delete guardrail policies during LLMJacking to gain access to a wider array of inference options.

## Triage & Response{% #triage--response %}

- Examine the `resourceId` and `properties.entity` fields on the triggering event to identify which Cognitive Services account and RAI policy `{{@usr.id}}` deleted.
- Verify if `{{@usr.id}}` has a legitimate business reason to delete this RAI policy, such as a documented decommissioning or policy-consolidation request.
- Determine which model deployments were using the deleted RAI policy, and whether they are experiencing any suspicious activity associated with LLMJacking.
- Determine whether replacement RAI policies used by deployments in the Azure AI Foundry account are missing important security controls such as prompt injection protection.