Prompt-injection scanner for Microsoft Copilot Studio

Where image PI enters Copilot Studio deployments

Teams image attachments processed by a bot. A Copilot Studio bot deployed in Teams can receive image uploads from any Teams channel member or direct-message sender. When the bot forwards that image to an Azure OpenAI vision model for analysis — helpdesk ticket triage, diagram explanation, error screenshot classification — the image is an untrusted input from whoever uploaded it. In organisations with guest access or external collaboration, this includes users outside the organisation's tenant boundary.

SharePoint file triggers in Power Automate. Power Automate flows triggered by new files in a SharePoint document library — a common pattern for document intelligence automation in M365 — pass those files to Azure OpenAI for classification, summarisation, or data extraction. Anyone with write access to the SharePoint library can add a file, which means any collaborator, contractor, or external vendor with library access can introduce an adversarial document.

Power Apps forms with image upload fields. Power Apps canvas apps often include image upload controls that feed into Power Automate flows for processing. A form that accepts photos of equipment damage, products, or documents and routes those photos to AI analysis has an unscanned image input from any user of the Power App — which may include external users on guest licenses.

Outlook and Exchange attachment processing. Power Automate's Outlook connector can trigger on new emails with attachments and forward those attachments to Azure OpenAI. Any external sender to your corporate email address is an untrusted input source. Email-based PI attacks are particularly accessible — the attacker only needs to send an email with a crafted attachment to any public-facing address in your organisation.

Integration: HTTP action in Power Automate

Power Automate's HTTP action (available on paid plans) can call any REST API. The scan gate adds two actions to your flow: an HTTP scan call and a Condition.

Step 1: After the action that retrieves the image binary (e.g., "Get file content" from SharePoint, "Get attachment" from Outlook, or the Teams file URL fetch), add an HTTP action:

Method: POST
URI: https://glyphward.com/v1/scan
Headers:
  Authorization: Bearer [your Glyphward API key, from Azure Key Vault]
  Content-Type: application/json
Body (JSON):
{
  "image": "@{base64(body('Get_file_content'))}",
  "source": "power_automate_copilot_studio"
}

Step 2: Add a Parse JSON action after the HTTP action to extract the score and scan_id from the response body. Use the schema:

{
  "type": "object",
  "properties": {
    "score": { "type": "integer" },
    "scan_id": { "type": "string" }
  }
}

Step 3: Add a Condition action.

If: body('Parse_JSON')?['score']   is less than   70
  Yes: Continue to Azure OpenAI connector
  No:  Send notification (Teams/email) with scan_id; terminate flow

On the "No" path, send a Teams notification to a security review channel with the scan_id and the source file reference. Do not send the image binary in the notification — reference the SharePoint or Outlook item by URL so the reviewer can access it with their existing permissions.

API key storage: Store the Glyphward API key in Azure Key Vault and reference it in the Power Automate HTTP action using the Azure Key Vault connector's "Get secret" action. Do not paste the key directly into the HTTP action — Power Automate flow run history logs request details that are visible to flow editors.

Get early access

Relationship to Azure Prompt Shields

Azure AI Content Safety's Prompt Shields (available in Azure OpenAI and Azure AI Studio) detects text-based direct and indirect PI attacks. It analyses the text of user messages and documents for instruction-following patterns that suggest PI. It does not analyse image bytes — when an image is passed to Azure OpenAI as a vision input, Prompt Shields does not inspect the image's pixel content for adversarial typographic overlays, steganographic payloads, or FigStep-class attacks.

Glyphward and Azure Prompt Shields are complementary: use Prompt Shields for text-based PI in chat messages and document text layers; use Glyphward for image bytes before any vision model call. Together they cover the full multimodal attack surface. See the Azure OpenAI integration guide for the full architecture pattern combining both layers.

Coverage matrix

Related questions

Further reading

• For Azure OpenAI — detailed integration guide for Azure OpenAI vision model calls, including Prompt Shields complementary architecture.
• FigStep detection — the typographic attack class most likely in Teams-shared screenshots and SharePoint document images.
• Indirect prompt injection via image — PI payloads in SharePoint-linked or OneDrive-linked images rather than direct uploads.
• For document AI pipelines — full integration guide for document extraction pipelines that process SharePoint or Outlook attachments.
• Multimodal LLM security API — general overview of the Glyphward scanning API.
• Why text-only scanners miss image prompt injection — architectural background.