Lab: Defender Security for AI Models

Preview guide for scanning risky Azure Machine Learning artifacts and adapting Defender SARIF and Sentinel content into a promotion gate.

Overview

This repository-first preview guide demonstrates defensive inspection of AI model artifacts, including unsafe pickle opcodes, synthetic embedded-secret patterns, and model-file behaviors that should block promotion into production. The deployment builds three fixtures by default and can optionally build a larger PyTorch checkpoint.

Guide Status

Guide reviewed July 10, 2026; no live Azure scan claim. Bicep, Bash, Python, JSON, workflow syntax, dependency resolution, and default fixture generation passed local or static checks. No Defender plan was enabled, Azure resource was deployed, or cloud/model scan was executed during this review.

Safety and Limits

  • AI model security is a preview capability. Confirm supported regions, licensing, pricing, portal behavior, and API component names in the target tenant.
  • The deployment leaves subscription-level Defender plans unchanged unless ENABLE_DEFENDER_PLANS=true is explicitly set. Its 2025-10-01-preview pricing-resource update reads the current plans before enabling them and preserves existing subplans, extensions, and extension properties. Privacy-sensitive prompt evidence can include relevant prompt/response snippets in alert evidence and requires the separate ENABLE_PROMPT_EVIDENCE=true consent flag, which is rejected without the plan opt-in; otherwise its current setting is preserved, and the Purview prompt-sharing extension is never altered.
  • The risky fixtures are deliberately crafted. Never deserialize them on a workstation; build and scan them only in a disposable sandbox/subscription.
  • ci/github-actions-model-scan.yml is a template, not an active workflow in this repository. It authenticates through the Defender for Cloud GitHub connector—not azure/login, Azure OIDC, or AZURE_* secrets—and accepts only same-repository pull requests. Fork commits must be reproduced by a maintainer on a trusted branch; the template never uses pull_request_target.
  • Before copying the template into a model-owning repository, connect that repository to Defender for Cloud and set DEFENDER_CLI_SHA256 to a reviewed 64-hex SHA-256 for the official Linux x64 CLI. The gate fails on scanner failure, absent or invalid SARIF, no supported model artifacts, or any SARIF result—not only critical findings.
  • The current cloud alert catalog documents the unified Ai.AIModelScan_MalwareDetected alert. CLI SARIF can contain unsafe-operator or exposed-secret findings without guaranteeing separate cloud alert IDs.
  • Cleanup deletes the lab resource group and purges matching disposable Key Vaults, but it deliberately leaves subscription-level Defender plans unchanged for manual review.

Start Here

  1. Review the canonical GitHub repository and its safety notes.
  2. Confirm the Azure roles, preview availability, public-network limitation, licensing, and expected charges before deployment.
  3. Follow the README through explicit plan opt-in (if required), deployment, defensive validation, Sentinel review, and cleanup.

There is no currently published companion article for this guide. The repository README is the source of truth for its preview limitations and commands.