[BUG] Azure.AI.OpenAI - Adding Tools to ChatCompletionOptions disables content filtering

[Mako217]

Library name and version

Azure.AI.OpenAI 2.9.0-beta.1

Describe the bug

When you send a request that should be filtered by content filter to AzureOpenAIClient, but you include any tools in the ChatCompletionOptions it doesn't get filtered. Just removing the tools and asking the same prompt makes filtering work again.
An important note is that it didn't start failing after a library upgrade, but just randomly started failing around 18th or 19th of March 2026. At that time I was using Azure.AI.OpenAI 2.2.0-beta.4, but after upgrading to the latest version it still doesn't work.

Expected behavior

CompleteChatAsync and CompleteChatStreamingAsync methods return System.ClientModel.ClientResultException: HTTP 400 (content_filter) when asked a question that should be filtered out.

Actual behavior

LLM responds that it's sorry that it can't answer. However the filter doesn't trigger and an exception isn't thrown.

Reproduction Steps

AzureOpenAIClient openAiClient = new AzureOpenAIClient(/*endpoint, credential*/);
ChatTool getTestTool = ChatTool.CreateFunctionTool(
    functionName: "test",
    functionDescription: "Test tool",
    functionParameters: BinaryData.FromObjectAsJson(new
        {
            Type = "object",
            Properties = new
            {

            },
            Required = new[] { "" },
        },
        new JsonSerializerOptions() { PropertyNamingPolicy = JsonNamingPolicy.CamelCase }
    )
);

List<ChatMessage> messages =
[
    new UserChatMessage(/*A prompt that should be filtered here*/)
];

ChatCompletionOptions options = new()
{
    Tools = { getTestTool }
};

var deploymentName = "gpt-4o";
var chatClient = openAiClient.GetChatClient(deploymentName);
var response =  await chatClient.CompleteChatAsync(messages, options);
Console.WriteLine(response.Value.Content[0].Text);

In this case the prompt won't get filtered out even if user asks questions related to self harm or illegal activities. However if you just comment out the Tools = { getTestTool } from ChatCompletionOptions initialization it will filter correctly and throws ClientResultException as expected.

Environment

I'm using gpt-4o model version 2024-11-20, but I checked it also on gpt-5.2 version 2025-12-11 and same thing happens

[github-actions]

🎯 Agentic Issue Triage

Thank you for your feedback. Tagging and routing to the team member best able to assist.

Summary: This issue reports a bug in Azure.AI.OpenAI (v2.9.0-beta.1) where adding ChatTool entries to ChatCompletionOptions causes Azure content filtering to stop functioning — filtered prompts receive a model-generated refusal instead of raising a ClientResultException with HTTP 400 (content_filter). This regression appeared around March 18–19, 2026, and persists across multiple package versions and model deployments.

🔍 Issue Analysis

Affected package: Azure.AI.OpenAI (path: /sdk/openai/)
Version reported: 2.9.0-beta.1 (also reproduced on 2.2.0-beta.4)
Affected methods: CompleteChatAsync, CompleteChatStreamingAsync
Models tested: gpt-4o (2024-11-20), gpt-5.2 (2025-12-11)

Behavior difference:

Scenario	Expected	Actual
ChatCompletionOptions with Tools	ClientResultException (HTTP 400 content_filter)	LLM soft-refusal, no exception
ChatCompletionOptions without Tools	ClientResultException (HTTP 400 content_filter)	✅ Works correctly

Key observations:

• The regression is not tied to a specific library version upgrade; it began on ~March 18–19, 2026 while using 2.2.0-beta.4
• This suggests a service-side behavior change in the Azure OpenAI API when tool calling is enabled, rather than a client SDK bug — but the SDK may need to handle or surface this differently
• Content filtering with tool-use is handled differently by the Azure OpenAI service; when tools are present, the API response may use a different finish reason or response structure

🛠️ Debugging Suggestions

1. Capture raw HTTP response: Enable HttpPipelineTransportOptions logging or use a network proxy (e.g., Fiddler) to capture the raw response when tools are present vs. absent. Compare the response body, finish_reason, and content_filter_results fields.

2. Check finish_reason: When tools are included and a filtered prompt is sent, check response.Value.FinishReason — it may return ToolCalls instead of a content filter result.

3. Check content filter results directly: The AzureChatCompletion response may expose ContentFilterResultForPrompt or similar. Inspect these fields to see if the filter did trigger but the exception was not raised.

4. Minimal repro with direct REST call: Try calling the Azure OpenAI REST API directly (e.g., via curl or Postman) with and without the tools parameter to confirm whether this is a service-side behavioral change.

5. Try ToolChoice = none: Set ChatCompletionOptions.ToolChoice = ChatToolChoice.None while keeping tools defined — this may isolate whether the presence of tool definitions or tool routing is responsible.

🏷️ Label Selection

• Category → Client: This is a data-plane client SDK issue with Azure.AI.OpenAI under /sdk/openai/
• Service → OpenAI: Directly matches the Azure.AI.OpenAI package
• Confidence: High — package and issue context are unambiguous
• No similar open issues found in the repository

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• releaseassets.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "releaseassets.githubusercontent.com"

See Network Configuration for more information.

Note

🔒 Integrity filtering filtered 8 items

Integrity filtering activated and filtered the following items during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• issue:[BUG] Azure.AI.OpenAI - Adding Tools to ChatCompletionOptions disables content filtering #57358 (issue_read: Resource 'issue:[BUG] Azure.AI.OpenAI - Adding Tools to ChatCompletionOptions disables content filtering #57358' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)
• #57358 (search_issues: Resource 'issue:[BUG] Azure.AI.OpenAI - Adding Tools to ChatCompletionOptions disables content filtering #57358' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)
• issue:[BUG] Azure.AI.OpenAI - Adding Tools to ChatCompletionOptions disables content filtering #57358 (list_issues: Resource 'issue:[BUG] Azure.AI.OpenAI - Adding Tools to ChatCompletionOptions disables content filtering #57358' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)
• issue:[QUERY] New version of Azure.ResourceManager.DevTestLabs #57342 (list_issues: Resource 'issue:[QUERY] New version of Azure.ResourceManager.DevTestLabs #57342' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)
• issue:[MPG Generator Bug] ModelFactory method for flattened properties passes default instead of constructing inner properties object #57334 (list_issues: Resource 'issue:[MPG Generator Bug] ModelFactory method for flattened properties passes default instead of constructing inner properties object #57334' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)
• issue:TCGC 0.66.3 is causing issues with PlanetaryComputer. #57325 (list_issues: Resource 'issue:TCGC 0.66.3 is causing issues with PlanetaryComputer. #57325' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)
• issue:HealthcareApis test recordings need re-recording (stale EventHub serialization) #57316 (list_issues: Resource 'issue:HealthcareApis test recordings need re-recording (stale EventHub serialization) #57316' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)
• issue:#0 (search_issues: Resource 'issue:#0' has lower integrity than agent requires. Agent would need to drop integrity tags [unapproved:all approved:all] to trust this resource.)

Generated by Agentic Triage for issue #57358 · ◷