Design solutions that align with security best practices and priorities · Topic 4 of 4
Secure AI Adoption and DevSecOps
SC-100 AI and DevSecOps: discovering and governing AI use, data and identity protection for AI, AI threat protection, and a CAF aligned DevSecOps process.
- 5 min
- AI risks: data leakage and oversharing, prompt injection, excessive agency, poisoning, shadow AI.
- Discover with Defender for Cloud Apps and Purview. Protect data with labels and DLP. Protect services with private endpoints, managed identities and Azure Policy.
- Azure AI Content Safety and prompt shields address harmful content and injection. Defender for Cloud covers AI workload threats.
What it is
Organizations are adopting generative AI quickly: employees use AI tools, developers build agents and copilots, and models connect to company data. Secure AI adoption is a strategy for getting the benefit while managing the new risks. DevSecOps is the delivery practice that builds security into every step of development, so the applications, including AI applications, are secure from the first commit.
How it works
Risks that are specific to AI
| Risk | Example |
|---|---|
| Data leakage and oversharing | An AI assistant surfaces files a user can technically open but should not see, or staff paste confidential data into an unapproved tool |
| Prompt injection | Hidden instructions in a document or web page change the model's behavior (direct or indirect) |
| Excessive agency | An agent has broad permissions and takes harmful actions |
| Model and data poisoning | Tampered training or grounding data changes outputs |
| Shadow AI | Unmanaged AI apps used without review |
| Harmful or non compliant output | Unsafe content, bias, or regulatory problems |
The OWASP Top 10 for LLM applications is a useful list of these risks.
A strategy for secure AI adoption
- Discover: find which AI apps and services are used and which data they touch. Microsoft Defender for Cloud Apps can discover generative AI apps and rate their risk, and Defender for Cloud can discover AI workloads in Azure. Microsoft Purview Data Security Posture Management for AI shows how AI interacts with data.
- Govern: define acceptable use, approval processes, and responsible AI principles. Use Azure Policy to require private networking, disable key based access and enforce approved regions for AI services.
- Protect data: classify and label data with sensitivity labels, apply DLP, fix oversharing and permissions before enabling an assistant over company data. Assistants such as Microsoft 365 Copilot respect existing permissions, so poor permissions become AI exposure.
- Protect identity and access: use managed identities and least privilege for applications and agents, Conditional Access for users and agent identities, and Microsoft Entra governance.
- Protect the platform: private endpoints, network isolation, encryption, and key management for AI services.
- Protect the model interaction: content filters, prompt shields and safety systems such as Azure AI Content Safety against harmful content and injection.
- Monitor and respond: Defender for Cloud threat protection for AI workloads, logging of prompts and responses where appropriate, and integration with Microsoft Sentinel and Defender XDR.
- Test: red team AI systems for injection, leakage and abuse before release.
Microsoft capabilities for AI security
| Need | Capability |
|---|---|
| Find AI apps in use and control them | Defender for Cloud Apps |
| Understand AI and data interaction, apply data controls | Microsoft Purview (sensitivity labels, DLP, DSPM for AI) |
| Detect attacks on AI workloads in Azure | Defender for Cloud threat protection for AI services |
| Filter harmful input and output | Azure AI Content Safety and prompt shields |
| Control who and what calls AI services | Microsoft Entra, managed identities, Conditional Access |
| Enforce configuration | Azure Policy and the MCSB AI guidance |
DevSecOps aligned to the Cloud Adoption Framework
DevSecOps joins development, security and operations. In the CAF Secure methodology it means security is part of the pipeline, not an end stage.
| Stage | Security practice |
|---|---|
| Plan and design | Threat modeling, security requirements, secure design reviews |
| Code | Secure coding standards, IDE and pre commit scanning, secret scanning with push protection |
| Build | Static analysis (SAST), software composition analysis for dependencies and licenses, IaC scanning, container image scanning |
| Test | Dynamic analysis (DAST), fuzzing and security tests |
| Release | Signed artifacts, approvals, least privilege service connections, protected branches |
| Deploy and run | Policy as code, runtime protection, Defender for Cloud and Defender for DevOps posture across repositories and pipelines |
| Operate and respond | Monitoring, incident response, and feedback of findings into the backlog |
Principles: shift left (find issues early, when they are cheap), automate checks as gates, treat pipelines as critical assets (they hold the keys to production), and give developers fast, actionable feedback.
A worked scenario
A bank wants employees to use an internal assistant over company documents. Before enabling it, the architect runs a permissions and oversharing cleanup, applies sensitivity labels and DLP, blocks unsanctioned AI apps with Defender for Cloud Apps, and puts AI services on private endpoints with managed identities. The team's pipeline gains threat modeling, SAST and dependency scanning, container scanning and signed images, with Defender for DevOps reporting posture to the security team.
What to remember for the exam
- AI risks: data leakage and oversharing, prompt injection, excessive agency, poisoning, shadow AI.
- Discover with Defender for Cloud Apps and Purview. Protect data with labels and DLP. Protect services with private endpoints, managed identities and Azure Policy.
- Azure AI Content Safety and prompt shields address harmful content and injection. Defender for Cloud covers AI workload threats.
- DevSecOps shifts security left with threat modeling, SAST, SCA, IaC and container scanning, and secret scanning.
- Fix permissions before enabling an AI assistant over company data.
When an AI question mentions "users can see more than they should through the assistant", the root cause is oversharing, and the fix starts with permissions, labels and DLP.
How the exam asks about this
- "Identify which generative AI apps employees are using." Defender for Cloud Apps discovery.
- "Prevent confidential data from being sent to an AI app." DLP and sensitivity labels.
- "Block jailbreak and injection attempts against an AI service." Prompt shields in Azure AI Content Safety.
- "Add security to the pipeline early." Shift left with threat modeling, scanning and secret protection.
Common mistakes
Enabling an assistant before cleaning up permissions. It exposes existing oversharing.
Giving agents broad permissions. Use least privilege and managed identities.
Treating AI as a separate program. Reuse identity, data, network and posture controls.
Scanning only at release. DevSecOps finds problems earlier.
Check yourself
Which risk lets hidden instructions in a document change an AI model's behavior?
Prompt injection.
Which service discovers and rates generative AI apps used by employees?
Microsoft Defender for Cloud Apps.
What does shift left mean in DevSecOps?
Moving security checks earlier in development, where problems are cheaper to fix.
Topic 4 of 4 in Design solutions that align with security best practices and priorities
Test yourself on Design solutions that align with security best practices and priorities
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.