What is Azure SRE Agent?
Azure SRE Agent is an AI-powered assistant that investigates and helps resolve incidents across your Azure environment. It analyses logs, metrics and operational data to identify issues and their likely causes.
What is Site Reliability Engineering (SRE)?
Site Reliability Engineering (SRE) applies software engineering principles to IT operations and infrastructure. Its goal is to keep applications reliable and scalable by automating incident response and routine maintenance, reducing downtime and improving service availability.
Azure SRE Agent became generally available on 10 March 2026. You can ask it questions in natural language, such as “Why is my database running slowly?” or “What went wrong after the last deployment?”
The agent investigates available telemetry, identifies potential causes and recommends appropriate actions. With the right permissions, it can also restart services, scale resources or change configurations, either with your approval or autonomously.
Azure SRE Agent Core Capabilities
- Incident investigation and response: Analyse alerts, logs, metrics and recent changes to identify likely causes and recommend or execute remediation.
- Proactive monitoring and checks: Schedule health, compliance and policy checks to identify potential problems before they cause incidents.
- Automated resource management: Run commands, execute runbooks, restart services and scale Azure resources with the appropriate permissions.
- Integrations with your existing tools: Connect Azure Monitor Alerts, PagerDuty and ServiceNow for incident response, plus observability platforms such as Datadog, Dynatrace, Splunk and New Relic through MCP. Kusto connectors support additional telemetry queries.
- Custom knowledge and extensions: Add repositories, runbooks, documentation and custom skills to give the agent context about your environment and operational procedures.
- Operational workflows and memory: Trigger notifications and updates through tools such as Teams, Outlook, GitHub and Azure DevOps, while using previous investigations to provide context for recurring issues.
The result? Less time spent investigating routine incidents and switching between tools, giving your engineers more time to focus on complex problems and software development.
Why use Azure SRE Agent?
SRE teams deal with unpredictable workloads, complex architectures and tight operational windows. When something goes wrong, traditional monitoring can tell you what is happening, but a human still has to work out why.
Someone still needs to check the logs, compare metrics, review recent deployments and piece together the evidence. That takes time, increases the on-call burden and can push up mean time to resolution (MTTR).
Azure SRE Agent helps close that gap by analysing large amounts of operational data, gathering context and investigating incidents. Think of it as an extra team member focused on reliability 24/7.
Business reasons
For senior leaders, the value comes down to more reliable systems and more productive engineering teams.
- Reduce mean time to acknowledge (MTTA): Give engineers a faster understanding of what’s happening when an incident starts.
- Reduce MTTR: Accelerate first-pass diagnostics, root cause analysis and remediation so services can recover faster.
- Reduce costly downtime: Fewer outages and faster recovery can protect revenue and customer experience.
- Lower the on-call burden: Let the agent handle more of the initial investigation so engineers only need to step in when their expertise is required.
- Free up engineering time: Spend less time checking metrics, restarting services and chasing routine issues, and more time on new features, modernisation and innovation.
- Reduce unnecessary cloud spend: Operational automation can help identify or act on resources that are no longer needed or can be scaled down.
Technical reasons
Azure SRE Agent can bring together the Azure data engineers normally have to investigate manually.
- Access Azure-native telemetry: Work with Activity Log data, Azure Monitor alerts, metrics and logs, plus Resource Graph and ARM metadata where configured.
- Analyse large amounts of data quickly: Review logs and metrics to identify patterns and likely root causes faster.
- Create structured incident briefs: Turn operational noise into a clearer summary of what happened and what needs attention.
- Suggest the next checks: Give engineers a starting point instead of leaving them to work through every signal manually.
- Standardise status updates: Use the information gathered during an investigation to create consistent incident updates.
- Take operational action: With the appropriate permissions, the agent can run commands, restart services, scale resources or perform other defined remediation actions.
Instead of jumping between dashboards, repositories and logs, your engineers get more of the operational context in one place.
Operational reasons
A large part of SRE work is repetitive. Azure SRE Agent can take some of that ops grunt work off your engineers’ plates.
- Create repeatable incident briefings: Follow a more consistent investigation process across teams and incidents.
- Standardise handovers: Give follow-the-sun teams consistent summaries of what happened, what has already been checked and what still needs attention.
- Create a single ops context entry point: Give on-call engineers one place to start investigating instead of searching across multiple systems.
- Automate repetitive tasks: Handle tasks such as checking metrics, running health checks, restarting services and applying routine fixes.
- Support proactive operations: Schedule checks and identify potential problems before they develop into full outages.
In some cases, much of the initial triage can already be complete by the time an engineer becomes involved.
Security and compliance reasons
Giving an AI agent access to production systems needs appropriate controls. Azure SRE Agent is designed to work within the access you give it.
- Limit access with Managed Identity and RBAC: Restrict the agent to the resources and actions it actually needs.
- Keep humans involved: Require approval for actions where you don’t want the agent operating autonomously.
- Reduce data exposure: Use data minimisation and supported private networking options where appropriate.
- Support auditability: Use Azure Monitor and Application Insights logging to retain visibility into operational activity.
You remain in control of where the agent can investigate and where it is allowed to act.
Permissions and run modes
Azure SRE Agent separates resource permissions from approval workflows. These are two different controls: permission levels determine what the agent can access, while run modes determine whether it needs approval before acting.
Permission levels are configured for each managed resource group:
- Reader (default): Gives the agent read-only access to investigate resources, review telemetry and diagnose problems without making infrastructure changes directly.
- Privileged: Gives the agent additional permissions to perform supported operational actions, such as restarting services or scaling resources.
Run modes are configured separately for each incident response plan and scheduled task:
- Review: The agent investigates and proposes an action, but waits for your approval before carrying it out.
- Autonomous: The agent executes permitted actions immediately, without waiting for approval.
Both controls work together. Giving an agent Privileged access does not automatically mean it can make changes without approval. And Autonomous mode does not give it permissions it doesn't already have.
On-behalf-of authorisation
One useful feature is on-behalf-of (OBO) authorisation. If the agent's managed identity doesn't have permission to perform an action, it can ask an authorised user for temporary approval to execute that action using the user's permissions.
For example, give the agent Reader access and ask it to fix a failing service. It can investigate the issue, identify a likely solution and explain what needs changing. If the fix requires permissions it doesn't have, the agent asks an authorised administrator to approve the action on their behalf.
Once approved, the agent performs the action using the user's permissions. Those permissions aren't retained afterwards, and the agent returns to operating through its managed identity.
This allows teams to start with read-only access while still supporting controlled remediation when intervention is necessary. On-behalf-of approval requires an SRE Agent Administrator using a supported Microsoft Entra work or school account.
Scalability and performance reasons
Azure SRE Agent can also fit into environments where workloads and operational demand change over time.
- Scale supporting workloads: Azure Functions and Container Apps can scale out as demand increases.
- Handle changing incident volumes: Automation can absorb repetitive operational work without requiring a person to perform every task manually.
- Plan for AI consumption: Select a model provider, such as Anthropic or OpenAI, at agent level. Active processing is billed in Azure Agent Units (AAUs), with consumption depending on the selected model and the work performed.
The overall value is straightforward: faster incident response, fewer repetitive tasks and more time for your engineers to work on the things that move the business forwards.
