Managing cloud environments often involves jumping between alerts, logs, dashboards, and code repositories when something breaks. Azure SRE Agent aims to simplify operational troubleshooting. The tool:
- Investigate incidents
- Automates routine workflows
- Helps resolve issues faster
What is the Azure SRE Agent?
The SRE Agent combines 1) Brain - Large Language Models (LLMs, either OpenAI or Anthropic models) with 2) Azure-specific product knowledge - tools and knowledge, and 3) Instructions - custom configuration. Allowing it to reason over operation support data.
The agent is deployed directly inside an Azure Resource Group, which sits within an Azure Subscription. I have only used the Reader Scope for my assigned identity permissions; it can operate in Reader Scope (for inspection and telemetry analysis) or Privileged Scope (to execute changes and automated mitigations).
The Azure SRE Agent operates across three main operational patterns
Automate Incidents: When an alert fires, the agent queries monitoring platforms, correlates signals across systems, determines probable root causes, and suggests or executes fixes
Automate Scheduled Workflows: It can perform scheduled background tasks, such as routine health checks and compliance sweeps
Investigate and Advise (Virtual Team Member): Engineers can ask natural-language questions (e.g., "what changed in the last hour?") in chat interfaces like Microsoft Teams to get grounded operational insights.
Running Incident Response Issues
Instead of forcing engineers to manually correlate disparate data, the agent follows a streamlined incident workflow: when an alert fires (in Azure Monitor, in my case), the SRE agent picks it up. It queries logs using correlation IDs to connect the data so that the agent can do the Root Cause Analysis & Ticketing: The agent identifies the probable cause (such as a bad commit or memory trend) and can prefill an incident ticket in ServiceNow or PagerDuty with diagnostic findings
The support engineer, in this case me, reviews and approves the remediation.
Connects natively with Azure Monitor, Application Insights, Log Analytics, PagerDuty, ServiceNow, GitHub, and Azure DevOps
Tip: External tools can also connect via the Model Context Protocol (MCP), basically making any API accessible.
Customisation: Capabilities can be extended using Skills (Azure CLI scripts and marketplace runbooks), Python tools, Custom sub-agents, and Agent hooks
Billing: Operational reasoning is metered using Agentic Units (AUs) rather than standard raw tokens, with standard monthly allocations; I still have no idea what this will cost or how it is calculated.
Summary
The Microsoft Azure SRE Agent provides a structured, governed way to use AI for incident management. By pulling together context from observability tools and code repositories into a single thread, it reduces tool switching and speeds resolution.
