Block Prompt Injection at the Network Layer with Microsoft Entra Prompt Injection Protection

A while back I built an LLM Firewall with AWS Lambda, an API screening demo that returns an allow/block decision for common prompt-injection patterns. That lab does not connect to an LLM; deploying the pattern in front of a model requires a separate integration for each protected application, and it provides no visibility into AI services outside that path.

That’s the core problem with app-level defenses. You’re counting on every application to protect itself, and most of them don’t. The ones you don’t even know about? Shadow AI services with zero protection.

Microsoft is taking a different approach by inspecting prompts at the network layer.

Prompt Injection Protection is a generally available capability in the Microsoft Entra Internet Access AI Gateway. It decrypts inspected TLS sessions, extracts prompts from supported AI services like ChatGPT, Claude, and DeepSeek, and runs them through Azure AI’s classifier before they reach the model. No code changes, no per-app proxies. One policy can cover multiple conversation schemes and custom JSON-based apps you define.

In this post, I’ll walk through configuring Prompt Injection Protection end-to-end, setting up TLS inspection, testing with controlled jailbreak payloads, and comparing it to the app-level approach. This is a guided configuration based on a validated environment, not a catalog lab with a companion repository.

The retained March 2026 graphics use the earlier “Prompt Shield” label and summarize that historical configuration. Their labels are not a current product matrix; the maintained text below states the current feature name and inspection boundaries.

Why Prompt Injection Is Becoming the New Phishing Problem

Phishing exploits trust in a communication channel. Prompt injection exploits trust in a conversation. Different targets, same technique: social engineering.

The parallels go further than you’d expect:

OWASP ranks prompt injection as LLM01:2025. The Agent Security Bench study, accepted at ICLR 2025, evaluated attacks and defenses across 13 LLM backbones and reported a highest average attack success rate of 84.30% in its tested settings—not an overall success rate for every agent or attack. More tool-enabled agents and MCP integrations expand the places where these controls need testing.

Email security went from “train users not to click” to gateway filtering. AI security needs to make the same jump.

What Prompt Injection Protection Detects

Prompt Injection Protection brings Azure AI Content Safety Prompt Shields classification to supported text prompts at the network layer. It detects direct prompt-injection patterns such as:

• System rule override — “Ignore all previous instructions”
• Conversation mockup — fabricating prior turns to manipulate context
• Role-play attacks — “You are DAN, Do Anything Now”
• Encoding attacks — base64, ROT13, character substitution to evade filters

App-level Prompt Shields can also analyze supplied document text for indirect injection. That is a separate integration: the Global Secure Access control does not inspect uploaded files, images, or PDFs.

MITRE ATLAS Mapping

OWASP’s LLM01 page cross-references MITRE ATLAS, the adversarial threat landscape for AI systems. The following three techniques are directly cited by OWASP:

Additional ATLAS techniques relevant to Prompt Injection Protection’s coverage (analyst mapping):

Architecture: Network-Level vs App-Level

Before diving into the configuration, here’s how Prompt Injection Protection compares to the app-level approach I covered in the LLM Firewall post:

They’re not competing — they’re complementary. App-level firewalls give you deep control over your own AI apps. Prompt Injection Protection gives you broad coverage across supported services, and GSA’s traffic logs show you what you haven’t configured yet.

Use both. Prompt Injection Protection at the perimeter, your own filtering for business logic. Same reason you run an email gateway and input validation.

Guided Configuration: Prompt Injection Protection End-to-End

Prerequisites

• Microsoft Entra tenant with Global Secure Access Administrator and Conditional Access Administrator roles
• A valid Microsoft Entra Internet Access license, including one provided through Entra Suite. A trial is available through the Entra admin center
• Windows 10/11 device (VM works), Entra joined or hybrid joined
• OpenSSL for TLS certificate signing

Step 1: Activate Global Secure Access

1. Navigate to Entra admin center > Global Secure Access > Dashboard
2. Click Activate to enable the service
3. Go to Connect > Traffic forwarding
4. Enable the Internet access profile (the Microsoft traffic profile is optional for Prompt Injection Protection but useful for broader GSA coverage)

Step 2: Configure TLS Inspection

This is the part that makes everything else work. Without TLS inspection, GSA can see where traffic goes but can’t read the request body to extract prompts. You need to break and inspect TLS to see what’s inside.

Generate and Sign the Certificate

1. Navigate to Global Secure Access > Secure > TLS inspection policies
2. Click the TLS inspection settings tab
3. Click Create certificate (this generates a CSR)
4. Download the CSR and sign it with your organization’s CA

For a lab environment, create a self-signed root CA and sign the CSR:

# Create a root CA with SHA-512
openssl req -x509 -newkey rsa:4096 -sha512 -days 1095 \
  -keyout rootCA512.key -out rootCA512.pem -nodes \
  -subj "/CN=Lab Root CA/O=Nine Lives Zero Trust/C=US"

# Sign the GSA CSR with required extensions
cat > signedCA_ext.cnf << 'EOF'
[signedCA_ext]
basicConstraints = critical, CA:TRUE, pathlen:1
keyUsage = critical, digitalSignature, keyCertSign, cRLSign
extendedKeyUsage = serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
EOF

openssl x509 -req -in GSALabCert.csr \
  -CA rootCA512.pem -CAkey rootCA512.key -CAcreateserial \
  -out GSALabCert-signed.pem -days 730 -sha512 \
  -extfile signedCA_ext.cnf -extensions signedCA_ext

Current certificate requirements: Microsoft’s BYOC guidance requires Server Auth, CA and key-usage extensions, and pathLenConstraint = 1 for its two-tier intermediate CA model. The example above reflects that current constraint; it was not newly enrolled during this source review. Historical lab observation: omitting serverAuth caused a Graph API 400 error on upload. That run used SHA-512; Microsoft’s sample uses SHA-256. Use a signing algorithm accepted by your PKI policy and the service rather than treating the CSR’s signature algorithm as a mandatory match.

5. Upload the signed certificate and its CA chain in the TLS inspection settings.
6. Set the uploaded certificate to Enabled; current Microsoft guidance says it defaults to Disabled and only one certificate can be enabled. Verify the certificate chain and inspected traffic after propagation. The earlier lab observed a 15–60-minute enrollment/propagation interval, which is not a current timing guarantee.

Create a TLS Inspection Policy

1. On the TLS inspection policies tab, click Create policy
2. Name: Inspect AI Traffic
3. Add rules targeting AI service FQDNs: chatgpt.com, claude.ai, gemini.google.com, chat.deepseek.com
4. Action: Inspect

Step 3: Create the Prompt Injection Protection Policy

1. Navigate to Global Secure Access > Secure > Prompt policies
2. Click Create policy
3. Name: Block AI Prompt Injection
4. Default action: Allow (only block detected prompt injection, not all traffic)

Add a Rule with Conversation Schemes

1. Click into the policy > Rules > Add rule
2. Name: Block Jailbreaks and Prompt Injection
3. Priority: 100
4. Action: Block
5. Add conversation schemes for each AI service you want to protect:
   • ChatGPT (Logged in) — extracts prompts from /backend-api/f/conversation
   • ChatGPT (Logged out) — extracts prompts from /backend-anon/conversation (note: no /f/ in the path). If your users browse ChatGPT without signing in, add a custom conversation scheme with this URL.
   • Claude — extracts prompts from Anthropic’s API
   • Gemini — extracts prompts from Google’s API (see note below)
   • DeepSeek — extracts prompts from DeepSeek’s API

Prompt Injection Protection ships with 11 preconfigured conversation schemes: ChatGPT, Claude, Cohere, DeepSeek, Gemini, Grok, Meta AI, Mistral, Perplexity, Pi, and Qwen. For custom AI services, you provide the URL pattern and JSON path to the prompt field.

Gemini note: Microsoft currently lists Gemini among the preconfigured conversation schemes. The control supports JSON request bodies, not URL-encoded payloads, so validate the exact Gemini endpoints and request formats your users reach before relying on enforcement. The dated lab evidence below shows the endpoints observed in this environment, not every Gemini flow.

Step 4: Link Policies to the Baseline Profile

1. Navigate to Global Secure Access > Secure > Security profiles
2. Click the Baseline profile tab > click into the baseline profile
3. Go to Link policies and link both:
   • Block AI Prompt Injection (Prompt policy)
   • Inspect AI Traffic (TLS inspection)

The baseline profile (priority 65000) applies to all internet traffic, including remote network traffic, without requiring a Conditional Access policy. For production, you can create custom security profiles linked to Conditional Access for more granular targeting (e.g., only apply Prompt Injection Protection to specific user groups).

Step 5: Deploy the GSA Client

For the GSA client to forward traffic, the Windows device must be Entra joined and have the client installed:

1. Download the GSA client from Global Secure Access > Connect > Client download
2. Install on the target Windows device
3. Import the root CA certificate to the Trusted Root Certification Authorities store
4. Block QUIC protocol (forces traffic to HTTPS where GSA can inspect it):

# Block QUIC to force HTTPS (required for TLS inspection)
New-NetFirewallRule -DisplayName "Block QUIC" `
  -Direction Outbound -Protocol UDP -RemotePort 443 `
  -Action Block

5. Disable Secure DNS (DNS-over-HTTPS) in your browser because GSA uses FQDN-based traffic acquisition, which requires plaintext DNS lookups. With DoH enabled, the browser resolves DNS through an encrypted channel that GSA can’t observe, causing traffic to bypass the tunnel entirely:

Edge:   edge://settings/privacy → "Use secure DNS" → Off
Chrome: chrome://settings/security → "Use secure DNS" → Off

Verify the GSA client is running:

Get-Service -Name "*GlobalSecureAccess*" | Format-Table Name, Status

You should see four services running: ClientManagerService, EngineService, ForwardingProfileService, and TunnelingService.

How It Works: The Request Flow

When a user on a GSA-enabled device sends a prompt to ChatGPT, here’s what happens:

Verifying Prompt Injection Protection

With everything configured, here’s what the lab validates.

GSA Client Connected

Once the Entra user signs in on the device, the GSA client connects with all three channels active: Internet, Entra, and M365.

TLS Inspection Active

Every HTTPS connection to an AI service now shows Microsoft’s intermediate CA in the certificate chain instead of the original:

Certificate chain for chatgpt.com:
  CN=chatgpt.com
  └── CN=Microsoft Global Secure Access Intermediate CA2
      └── CN=GSA Lab CA
          └── CN=GSA Lab Root CA (self-signed)

This confirms GSA is decrypting, inspecting, and re-encrypting targeted AI traffic in real time.

Prompt Inspection in Gen AI Insights

The Generative AI Insights logs (under Global Secure Access > Monitor) show matched prompts sent to supported AI services through the tunnel:

This is the kind of visibility you can’t get from an app-level firewall. You see who sent what, to which service, and when. If you’re running a SOC, this is the difference between blind spots and actually knowing what’s happening.

Jailbreak Blocked

With normal prompts flowing through without issue, here’s what happens when a jailbreak prompt is sent to ChatGPT:

Normal conversation works. Jailbreak gets blocked. The traffic logs for Gemini show a similar pattern: connections during jailbreak testing show a mixed action status (displayed as “Composite” in the portal) with non-zero blocked transaction counts. Microsoft’s traffic log documentation defines the Action field as Allowed or Denied and notes that connection logs aggregate multiple transactions. The blocked counts we observed indicate enforcement occurred on those connections:

Key Takeaway: Conversation Scheme URL Matching

The most important lesson from this configuration: the conversation scheme URL must exactly match the AI service’s API endpoint. ChatGPT uses different paths for logged-in (/backend-api/f/conversation) vs anonymous (/backend-anon/conversation) users. If the URL doesn’t match, Prompt Injection Protection sees the traffic but can’t extract the prompt to classify it.

The 11 preconfigured conversation schemes handle this for common AI services. For custom AI apps, you’ll need to identify the exact POST endpoint and JSON path using browser developer tools.

Limitations and Gotchas

No security control is perfect, and Prompt Injection Protection is no exception. Here’s what I ran into and what you should know:

1. Text-only: Prompt Injection Protection analyzes text prompts. It does not inspect images, PDFs, or file uploads sent to AI models.

2. JSON-only: The conversation scheme extractors work with JSON request bodies. URL-encoded payloads and other unsupported formats are not inspected by this control.

3. 64,000-character limit: Microsoft documents prompt support up to 64,000 characters; longer input is truncated. Treat this as a coverage boundary and test oversized-input handling in the application as well as at the network layer.

4. Windows client required: While GSA clients exist for macOS, iOS, and Android, the current Prompt Injection Protection guidance specifically requires Windows 10/11 devices that are Entra joined or hybrid joined.

5. TLS propagation delay (lab observation): In our testing, TLS inspection took 15-60 minutes to become active across GSA edge PoPs after uploading the signing certificate. During this window, traffic flows but is not inspected.

6. Rate limits: Under heavy load, Prompt Injection Protection applies rate limits. When rate-limited, subsequent requests are blocked regardless of content, which can impact legitimate users.

7. Language coverage: The underlying classifier is trained on Chinese, English, French, German, Spanish, Italian, Japanese, and Portuguese. Other languages may have reduced detection accuracy.

What About Shadow AI?

This is where the network-level approach really pays off. With GSA’s Internet Access forwarding profile, you can see AI traffic beyond the services you’ve sanctioned.

Global Secure Access application usage analytics (currently in preview) can identify shadow IT, generative AI apps, and shadow AI applications. For more established shadow-IT discovery and control, Microsoft also offers Defender for Cloud Apps. Together, these provide:

• Discovery: Identifies AI services being used across your network
• Risk assessment: Categorizes discovered AI services by risk level
• Blocking: Web content filtering can block unsanctioned AI services entirely

Combined with Prompt Injection Protection, you get a two-layer defense:

1. Block unsanctioned AI services entirely with web content filtering
2. Inspect sanctioned AI services for prompt injection with Prompt Injection Protection

Production Deployment Considerations

A few things to think about if you’re taking this beyond a lab:

Conditional Access Integration

Instead of applying Prompt Injection Protection to all users via the baseline profile, create a custom security profile and link it to a Conditional Access policy. This lets you:

• Target specific user groups (e.g., apply stricter policies to developers who use AI heavily)
• Apply different policies for different risk levels (e.g., stricter blocking for high-risk sign-ins)
• Exclude service accounts or break-glass accounts

User Experience When Blocked

When Prompt Injection Protection blocks a prompt, it terminates the connection. In our test environment, the user saw the AI app’s own error message (e.g., ChatGPT showed “Something went wrong”). This is different from web content filtering, which shows a customizable block page. Communicate to users what blocked AI errors mean via:

• Your organization’s acceptable use policy
• Internal documentation explaining Prompt Injection Protection behavior
• A helpdesk contact for reporting false positives

Monitoring

GSA traffic logs flow to Log Analytics. Build Sentinel analytics rules to alert on:

• Spike in blocked prompt injection attempts (possible targeted attack)
• New AI service discovered in shadow AI detection
• TLS inspection certificate approaching expiration
• Rate limit events (possible false positive wave)

Certificate Management

The TLS inspection certificate has a fixed validity period. Set a calendar reminder to rotate it before expiration. An expired certificate can break TLS inspection and Prompt Injection Protection until rotated.

Conclusion

Email security evolved from per-mailbox filters to centralized gateways that everyone expects to have. AI security is heading in the same direction.

Prompt Injection Protection is generally available, although its supported services and platform requirements continue to evolve. The direction is right: move prompt inspection to the network layer where security teams have visibility across the environment, not just the apps they built.

If you already have app-level prompt filtering, keep it. Prompt Injection Protection covers the perimeter and app-level controls handle business logic. Using both is the right model.

Resources

• Prompt Injection Protection documentation (Microsoft Learn)
• Azure AI Content Safety: Prompt Shields (Microsoft Learn)
• TLS inspection settings for Global Secure Access (Microsoft Learn)
• Global Secure Access traffic logs (Microsoft Learn)
• Global Secure Access known limitations (Microsoft Learn)
• Application usage analytics (shadow AI) (Microsoft Learn)
• OWASP LLM01:2025 Prompt Injection (OWASP)
• MITRE ATLAS (MITRE)

Prompt Injection Protection is generally available. You need a valid Microsoft Entra Internet Access license and supported Windows device configuration. Check Microsoft’s documentation for the current support matrix before production rollout.

Jerrad Dahlager, CISSP, CCSP

Cloud Security Architect · Adjunct Instructor

Marine Corps veteran and firm believer that the best security survives contact with reality.

Have thoughts on this post? I'd love to hear from you.

LinkedIn Email Me

You might also like

AI Security

Agent 365 Launch Playbook: I Tested the Defender Response for AI Agent Attacks

See an Azure AI application test jailbreaks, XPIA, instruction leakage, …

16 min read

AI Security

Building an LLM Prompt Injection Firewall with AWS Lambda

Deploy a serverless first-pass firewall for common direct prompt-injection …

14 min read

AI Security

Sentinel MCP Server: Securing Your SOC's New AI Attack Surface

Microsoft's Sentinel MCP Server lets AI agents query your security data lake. …

15 min read