Microsoft Defender for AI Services alerts are flowing to the Microsoft Sentinel workspace via a single connector path
Overview
Section titled “Overview”Defender for Cloud’s AI threat protection plan detects attacks against Azure OpenAI and Azure AI Services accounts in real time. For those alerts to reach Microsoft Sentinel, two conditions must be met: the plan must be enabled at the subscription level, and exactly one connector path must forward alerts to the workspace — running more than one path simultaneously produces duplicate incidents. This check verifies both conditions are met.
When the Defender for AI Services plan is not enabled, attacks against Azure OpenAI and Azure AI Services accounts generate no security alerts regardless of how Sentinel is configured. Threat actors who target AI endpoints with prompt injection, jailbreak techniques, or data extraction queries can exploit this absence because there is no detection layer to observe or interrupt their activity. Without this plan, the organization cannot detect any of the AI-specific attacks in the Defender for AI Services alert reference — prompt injection, jailbreak attempts, wallet exhaustion, and sensitive data exposure all go unobserved.
Remediation
Section titled “Remediation”- Defender for AI Services overview
- Defender for AI Services alert reference
- Enable Defender for AI Services pricing plan
- Ingest Microsoft Defender for Cloud alerts to Microsoft Sentinel (Tenant‑based and Legacy connectors)
- Ingest Microsoft Defender for Cloud incidents with Microsoft Defender XDR integration
- Microsoft Sentinel + Defender XDR: preventing duplicate Defender for Cloud alerts
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | AI |
| Category | AI Threat Detection |
| Product | Azure |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | Microsoft_Defender_for_AI_Services, Microsoft_Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.