Azure AI Content Safety Pricing: Records, Images, and Total Cost

Azure AI Content Safety pricing uses records rather than LLM tokens. Microsoft's Content Safety pricing page defines a Standard text record as up to 1,000 Unicode code points. A 7,500-character submission counts as eight text records, while image analysis uses a per-image meter.

The meter is simple enough to put on a whiteboard. Production cost still depends on where the application calls the service. Assessing the prompt and an attached document before checking the response can turn one visible user interaction into several billable operations. I dislike forecasts that label all of those calls "moderation" and hide the sequence. The order of those calls determines the budget.

TL;DR

Azure meters text by 1,000-code-point records and image analysis by images submitted.
One user interaction can trigger prompt and document assessments, followed by model-response checks.
The public page exposes Free and Standard tiers, but local prices vary by agreement and date. Currency also affects them.
Model inference and Azure diagnostics shape total cost. Engineering and human review add to it, as do duplicate calls.

The published text and image meters

The pricing page lists a Free Web tier with monthly allowances for text and images. It displays 5,000 text records and 5,000 images per month for the listed capabilities. The Standard Web tier is billed per 1,000 text records and per 1,000 images. Microsoft groups Text and Prompt Shields under the text side of the public table. It also places protected-material detection and groundedness detection there.

Microsoft warns that displayed prices are estimates. Actual pricing can vary with the agreement and purchase date. The currency exchange rate and selected program can also change it. The page rendered without a usable local Standard rate during this review, so this article avoids inventing one. Use the Azure calculator or a written quote for the subscription and region that will receive the traffic.

Text-record rounding applies to each submitted input. A 500-code-point body consumes one record. A 1,001-code-point body consumes two. Image submissions are counted separately. That makes average characters per request and the long tail of uploaded documents more useful than monthly active-user count. The number of moderation stages matters too.

API placement determines record volume

The Azure AI Content Safety overview lists APIs for text and image analysis. It also lists Prompt Shields and groundedness detection. Protected-material text detection and task adherence appear as separate capabilities, along with custom categories. Each capability solves a different moderation problem, and the application decides which content reaches which endpoint.

Consider an assistant that accepts a user prompt plus a retrieved document. The application may scan the prompt for a user-input attack, scan the document for hidden instructions, send the resulting context to an LLM, analyze the output for harm categories, and run protected-material detection on the answer. A user sees one response while the architecture executes several Content Safety operations with different payloads.

Build the estimate as an ordered call map:

User prompts submitted to Prompt Shields.
Documents or tool responses assessed for indirect attacks.
Text sent to harm-category analysis.
Model output sent to protected-material or groundedness checks.
Images sent to image analysis.
Retries and fallbacks triggered by application logic.
Duplicate checks triggered by application logic.

The drawing should fit on one page, with a counter beside each arrow. Missing counters leave finance unable to reproduce the eventual usage.

Prompt Shields adds two input surfaces

Microsoft's Prompt Shields documentation distinguishes user prompt attacks from document attacks. User prompt attacks try to bypass system instructions or safety training. Document attacks hide instructions in third-party content such as documents and emails, as well as web pages.

That split between user and document attacks directly affects assessment volume. A chat application may send one user prompt to the shield and several retrieved documents for document-attack analysis. Longer documents also cross more 1,000-code-point boundaries. The moderation plan should name whether it scans each retrieved chunk or one combined context. It may instead select sources based on risk.

Prompt Shields can run through Foundry guardrail controls, while direct Content Safety integrations can call APIs explicitly. The bill and diagnostic trail follow the actual path. Count configured intervention points rather than assuming Azure applies one universal check to every call.

This is also where a concrete payload policy helps. Record the content type and code-point count. Add the API called and resource, followed by the region and response status. Include the correlation ID. Keep sensitive prompt text out of cost dashboards unless the review requires it. A usage ledger needs enough detail to explain the meter without becoming a second copy of every confidential prompt.

Total cost extends past Content Safety usage

Azure AI Content Safety is one line in a larger deployment. Azure OpenAI or another model provider bills inference separately. API Management and Functions can contribute charges depending on the design. So can Container Apps and storage. Log Analytics and Application Insights add another pair of possible charges, while private networking and Key Vault may add more. Human moderation queues add staff cost when the service flags content for review.

Engineering work adds cost through threshold settings and blocklist maintenance. Language evaluation and attack tests add more. Regional resources matter, as does the action chosen for each result. Azure's text-analysis quickstart returns severity values for sexual content and violence, along with hate and self-harm; the application still needs an action policy for those results.

I budget seven lines:

Standard text records and image submissions.
Azure OpenAI or other model inference.
Gateway and application compute.
Diagnostics and retention, plus query costs.
Network and security services.
Engineering for integration and regression testing.
Human review and appeal handling.

Keep Free-tier capacity out of a production baseline unless the Azure subscription terms and traffic shape make that allowance dependable. A free allowance can support a development environment while production uses a separate resource and Standard meter.

Usage controls for a defensible forecast

Sample real payloads before choosing a monthly record estimate. Calculate rounded records per call, then segment by prompt and document. Keep response and image traffic in separate segments. Use p50 and p95 sizes because a few long documents can dominate record consumption. Preserve the source data for the forecast so procurement can rerun it after the product changes.

Separate environments by resource or tagging convention. Development regression suites can create a regular burst of checks that looks like production growth. Record the API feature because Prompt Shields and groundedness answer different questions. Protected material and basic text analysis also serve separate purposes, even when the pricing page places them under a text-record heading.

Set an alert on records per completed user interaction. That ratio exposes accidental duplicate calls after retries or middleware changes. It also catches an agent loop that repeatedly sends the same document through Prompt Shields. A flat request alert misses that multiplication.

The final quote should name the Azure region and offer. Include the currency and date. Microsoft explicitly says price depends on commercial and currency conditions. Store the quote beside the architecture assumptions rather than copying a temporary web value into a long-lived cost model.

Microsoft moderation and enterprise authorization stay separate

Azure AI Content Safety analyzes content and returns moderation or attack signals for configured Azure resources. Microsoft Entra ID or managed identity can authorize access to the Content Safety resource. Those controls establish who may call the service and what the classifier reports.

An enterprise AI policy can ask a narrower request question: may this authenticated employee or agent send this data class to this model destination under the active policy? The answer needs identity context and the intended model route. It also needs the organization's policy version. A Prompt Shields result can inform that decision, but it covers the detected attack signal rather than the caller's full entitlement.

DeepInspect vs Azure AI Content Safety describes the two control layers. Azure OpenAI security covers the provider-side configuration, and AI gateway architecture shows where a separate HTTP policy point can sit. Use Content Safety for the Microsoft classifiers it documents. Use enterprise authorization for identity-bound route policy.

DeepInspect

DeepInspect evaluates authenticated user or agent traffic deliberately routed through its HTTP proxy. The application supplies identity and request context; DeepInspect applies the active route policy and records the resulting decision before allowed traffic reaches the LLM endpoint. That decision may permit or deny the request, or redact content.

Azure AI Content Safety remains responsible for its text and image assessments. It also remains responsible for Prompt Shields and groundedness, along with protected-material assessments. DeepInspect leaves those Azure usage meters and regional rates unchanged. Where the architecture calls a Content Safety API during policy evaluation, the Azure result can be referenced in the separate per-decision record without turning a moderation verdict into an identity claim.

Book a technical deep dive at deepinspect.ai.