Intermittent Azure OpenAI Content Filter Blocking a Benign Appointment Booking Chat Due to High Violence Detection

Recommended mitigation is to treat this as a content filtering false positive and reduce sensitivity where allowed, then inspect annotations/logs to confirm what actually triggered the block.

1. Check whether the block is coming from the default safety policy or a configurable filter.
   • Azure OpenAI applies default safety policies to prompts and completions.
   • When content exceeds the configured severity threshold, the API blocks the request and returns an error indicating the category.
   • For text models, the default threshold for violence, hate, sexual, and self-harm is Medium on both prompts and completions.
2. Create and attach a custom content filter to the affected deployment.
   • In Azure AI Foundry, content filtering configurations are created within a Resource and associated with Deployments.
   • For each category, prompts and completions can be configured separately.
   • For violence on prompts, possible settings are:
     • Low, medium, high
     • Medium, high
     • High
   • If benign traffic is being blocked, moving the prompt-side violence filter to High is the least permissive supported relaxation available to all customers.
3. Enable annotations and review the returned filter results.
   • Annotations can be enabled even when blocking is disabled for some levels.
   • For standard content filters, the API can return:
     • category
     • severity level
     • filtering status
   • This helps confirm whether the request is truly being classified as violence-high or whether another optional model such as prompt attack detection is involved.
4. Check prompt shield behavior, not only violence.
   • The screenshot text indicates a possible prompt injection/jailbreak attempt.
   • Azure has Prompt Shields for user prompt attacks, which detect attempts such as changing system rules, replacing the model persona, embedding fake conversation turns, or asking for encoded outputs.
   • If the user message is simple but the request is still intermittently blocked, inspect the full assembled prompt sent by Semantic Kernel, including chat history, tool outputs, memory, and any grounded documents. A benign final user utterance can still be blocked if earlier or injected context in the composed prompt is flagged.
5. Use document delimiters if grounded content is included.
   • For indirect attack detection, document delimiters are required when constructing the prompt.
   • If the bot injects retrieved content, CRM notes, or other external text into the prompt, delimiting that content can help the system distinguish user intent from embedded instructions.
6. If the scenario still needs looser filtering, apply for modified content filtering.
   • Full control, including No filters or Annotate only, requires approval for modified content filtering.
   • Without that approval, the default system filter still applies for most customers.
7. For intermittent failures, add application handling.
   • Since the same flow often succeeds on retry, handle these as transient safety blocks in the app:
     • log the full filter response
     • capture category/severity/filtered values
     • return a neutral retry message to the user
     • avoid changing the user-visible wording unless logs show a repeatable trigger

For the specific appointment-booking flow shown, the most likely next step is:

• attach a custom content filter to that deployment,
• relax prompt-side violence from Medium, high to High,
• enable annotations,
• inspect whether the actual trigger is violence or prompt shield detection from the fully composed Semantic Kernel prompt.

• Content filter configurability
• Default Guardrail policies for Azure OpenAI
• Content filtering annotations
• Prompt shields content filtering
• Content filtering for Microsoft Foundry Models (classic)
• Default Content Filters Blocking Legitimate Personal Data in Real-Time GPT Bots - Microsoft Q&A