Azure Compliance ControlsAzure API Management
API Management instances should have LLM jacking threat detection enabled
This control checks API Management instances for LLM jacking threat detection. It analyzes API Management diagnostic logs in Log Analytics for LLM-related operations, and it groups the requests in those logs by the caller IP address.
What this control checks
No potential LLM Jacking attacks detected across all Azure API Management instances
Framework mappings
The clauses this control is mapped to in each framework.
- DEV-02.01AC The cloud service provider documents and implements a procedure that makes it possible to supervise and control the outsourced development activity, in order to ensure that the outsourced development activity is compliant with the secure development policy of the cloud service...
Related controls
- API Management services should have client certificates enabled
- IoT hubs should have resource logs enabled
- Azure subscriptions should have an Activity Log Alert configured for Create Policy Assignment
- Flow log resources should have flow logging enabled
- Azure subscriptions should have Microsoft Defender for Containers enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_apim_threat_detection_llm_jacking - Prowler Check:
apim_threat_detection_llm_jacking
Last reviewed: 2026-10-11