AI workloads introduce familiar cloud-security requirements and several new ones. Identity, network isolation, secrets management and least privilege still matter, but generative applications also consume untrusted text, call tools dynamically and may expose data through prompts or model outputs. Securing the workload means protecting the entire path from user input to retrieval, model execution, agent tools and downstream systems.<\/p>\n
For AI-103, security is a design responsibility rather than a final configuration step. The Microsoft AI certifications<\/a> path increasingly expects developers to make identity and governance choices at the same time they choose models, retrieval and agents.<\/p>\n Managed identities and Microsoft Entra ID allow applications and agents to authenticate to Azure resources without placing long-lived credentials in code, configuration files or prompts. This reduces the risk of secret leakage and makes access easier to revoke centrally.<\/p>\n Authentication is only the first step. Azure RBAC determines what the identity can actually do. A project that only reads from Azure AI Search should not receive broad contributor rights. An agent that inspects storage should not automatically be allowed to delete blobs. Least privilege limits the consequences of both developer error and model misbehavior.<\/p>\n The distinction between service identity and user identity also matters. Some applications act with their own permissions, while others need to preserve the authorization context of the signed-in user. The architecture should be explicit about whose authority is being exercised for every sensitive call.<\/p>\n Public endpoints may be acceptable for prototypes, but enterprise workloads often require private network paths to models, search indexes, storage and state services. Foundry supports private networking options that can restrict inbound access and isolate agent egress.<\/p>\n A private endpoint protects how callers reach a resource. Egress isolation controls where the application or agent can connect outward. These are related but different decisions. An endpoint can be private while an agent still has broad outbound internet access if egress is not constrained.<\/p>\n Network architecture should therefore be driven by the data boundary. If an agent must query private Azure AI Search or Storage, those dependencies need reachable private paths and the correct identities. A secure design considers DNS, private endpoints, routing and service permissions together rather than assuming that one checkbox creates isolation.<\/p>\n RAG can accidentally become a data-exposure mechanism if a shared index contains content from several security domains and retrieval ignores user permissions. Once restricted text is placed into the model context, asking the model not to reveal it is too late.<\/p>\n Filters, metadata and identity-aware queries should prevent unauthorized documents from being retrieved. Separate indexes may be appropriate when data boundaries are strong. The search layer should also preserve provenance so the application can audit which source material influenced an answer.<\/p>\n Private data should be minimized in prompts. If a task can be completed with a few relevant fields, there is no reason to send an entire customer record or document collection into the model context.<\/p>\n Agents read email, webpages, documents and tool output. Any of that content can include text that tells the model to ignore previous instructions, reveal sensitive information or call a dangerous tool. The application should treat those strings as untrusted data rather than as authoritative instructions.<\/p>\n Model-level defenses are useful but not sufficient. Tool permissions, action validation, output filtering and approval checkpoints reduce the impact of a successful injection. If an agent that reads documents has no permission to send external email, a malicious document has less ability to exfiltrate information.<\/p>\nUse identity instead of embedding reusable secrets<\/h2>\n
Private networking changes the threat surface<\/h2>\n
Retrieval systems must enforce authorization before data reaches the model<\/h2>\n
Prompt injection requires trust boundaries around external content<\/h2>\n