Prompt Injection and Runtime Defenses

Prompt injection takes a different route with agents: the instruction arrives in a document or an email, not the prompt. Microsoft operates the runtime defenses; the customer controls how far an injected instruction can reach.

In GCC High

Every row below is a documented claim until a tenant check turns it into an observation. The basis column says which, and when.

Control	GCC High	Basis
Defender for Office 365 Plan 2: prompt injection protection at mail flow	Undocumented Tenant check: the Threat Explorer detection technology filter.	Documented 2026-09-24 (the page names no cloud)
Microsoft-operated runtime mitigations (block list, Unicode sanitization, spam exclusion, tool chain analysis)	Undocumented	Documented 2026-09-24 (the page names no cloud)

#	Where to look	Microsoft documents	If the tenant disagrees
8	Defender portal (GCC High), Threat Explorer: the detection technology filter, for Prompt injection protection; and the alerts queue after an injection test, for jailbreak classifier alerts	Defender for Office 365 Plan 2 detection at mail flow, and classifier alerts in the Defender portal; neither page names GCC High	Confirms the upstream and detection layers. Absence leaves the injection requirement resting on architecture and the egress gate alone.