From Alert to Resolved: Constructing a Self-Therapeutic Azure Platform with SRE Agent

Hi there Of us!

It’s 3 a.m. Your telephone lights up. A crucial workload that spans a number of clouds is on hearth, possession is fuzzy, the alert routed to the flawed staff first, and now it’s your downside. You sit up in mattress, chilly and groggy, and begin the ritual. Open the runbook. Pull logs from one place. Pull metrics from one other. Stare at three dashboards. None of them inform the entire story. So that you construct a concept. The speculation is flawed. The clock retains ticking. The shopper impression retains climbing. Each flawed flip prices you time, context, and confidence.

That’s the scene Lee Oommen opened with at MAIS14, and it’s the purpose Azure SRE Agent exists. On this session, Lee walks via the 4 traditional SRE ache factors and reveals how an agentic operations platform compresses MTTR from hours to minutes. I’m going to unpack what he confirmed, why it issues for IT professionals, and find out how to get your palms on it.

If you happen to carry a pager, write runbooks, or get pulled into post-mortems, this one is for you.

• The clock is the enemy, not the incident. Lee stated it plainly: there may be nearly at all times an skilled who can repair the issue. The true harm comes from the minutes spent discovering that skilled and reconstructing context.
• Dashboards lie in each instructions. False positives create alert fatigue. False negatives let the shopper name you earlier than your displays do. Neither end result is suitable.
• RCAs take weeks as a result of the reply by no means lives in a single layer. Infrastructure, community, deployments, dependencies, databases, app code. You want somebody, or one thing, that may correlate throughout all of them in a single cross.
• You didn’t turn out to be an SRE to be a dashboard watcher. Toil is the work that holds again the individuals who needs to be designing reliability into the subsequent technology of providers.

Let’s begin with what it’s not. It’s not a dashboard. It’s not a monitoring device. It’s not a chatbot.

Azure SRE Agent is an end-to-end agentic operations platform. Consider it as a senior SRE who sits inside your staff, works 24 by 7, by no means will get drained, by no means misses a sign, and is fluent in your stack.

• Causes over telemetry, not simply textual content. It pulls metrics, logs, traces, deployment historical past, and exercise logs, then correlates throughout them.
• Takes ruled actions. Each motion runs contained in the permission boundary you outline. You determine whether or not the agent proposes a repair, asks for approval, or acts autonomously.
• Authors RCAs in minutes, not weeks. It traces the foundation trigger in a single circulate throughout your entire stack and produces the report instantly after remediation.
• Remembers. It captures organizational reminiscence from each incident, each chat, and each scheduled job, then applies it to the subsequent investigation.

Lee referred to as it the operations half of DevOps, and that framing caught with me. We have now automated construct and deploy. The operations aspect has been caught in toil. SRE Agent closes that loop.

Lee demonstrated the total loop reside. Here’s what it appears to be like like finish to finish.

1. Detect. The agent integrates with Azure Monitor, PagerDuty, or ServiceNow. When an alert fires, the agent acknowledges it inside seconds. The human doesn’t need to get up chilly.
2. Examine. The agent runs diagnostics in parallel throughout the related sources. It queries Log Analytics, App Insights, Azure Monitor metrics, and any third-party observability instruments you wired in via MCP connectors.
3. Correlate. It makes use of distributed tracing, cross-workspace KQL queries, and time-based sign alignment to attach dots throughout providers that don’t even share hint IDs. It additionally checks previous incidents in reminiscence to see if this appears to be like acquainted.
4. Diagnose. It produces a root trigger evaluation with the related proof linked inline. No extra reconstruction train throughout a number of groups.
5. Suggest or Act. Based mostly in your run mode and the permissions granted, the agent both proposes a repair and waits for approval, or executes the remediation autonomously. Lee demonstrated each. He arrange a nasty slot swap on Azure App Service, generated HTTP 500 errors, watched the agent acknowledge the alert, examine, establish the unhealthy slot, ask for permission, after which carry out the slot swap to revive the service.
6. Shut the loop. The agent recordsdata a GitHub or Azure DevOps subject with full context, opens a pull request with proposed code adjustments when applicable, and writes a session insights abstract you may assessment.

Three modes to work together with it:

• Interactive. Chat with the agent like a copilot. Most clients begin right here to construct belief.
• Reactive. Occasion-driven. The agent reacts to incidents from Azure Monitor, PagerDuty, or ServiceNow. One agent per incident platform.
• Proactive. Scheduled duties that run each 5 minutes, each hour, day by day, or weekly. Certificates well being audits, well-architected framework assessments, price optimization sweeps, compliance checks. Lee confirmed a scheduled job that flagged a certificates expiring in 50 days earlier than it might ever hearth an alert.

That is the place the dialog will get sensible. Just a few issues from Lee’s demo and the reside Q&A that I need to name out.

• Multi-cloud actuality. SRE Agent lives in Azure however will not be restricted to Azure. Customized runbooks, Python execution, MCP servers, and connectors let it orchestrate throughout AWS, GCP, and on-premises. Deal with it because the central SRE mind.
• Your information stays yours. Every agent will get a devoted information retailer in your subscription and useful resource group. Reminiscence, information, threads, and session insights reside in your chosen area. Nothing is used to coach the mannequin supplier. Encryption at relaxation, TLS 1.2 in transit, Azure RBAC, managed id, customer-managed keys all apply.
• Id boundary you already know. The agent makes use of customary Azure managed id. Grant the id RBAC on any cross-subscription useful resource it wants to achieve. Least privilege nonetheless applies.
• Area availability. At session time, brokers might be deployed in EastUS2, Sweden Central, and Australia East. The listing is updating roughly month-to-month. Canada is coming. An agent in a single area can act on sources globally, however you probably have information residency guidelines, deploy the agent inside the identical jurisdiction.
• Personal endpoints at this time. In case your Log Analytics Workspace or databases are absolutely locked down behind personal endpoints with public entry disabled, the agent at present wants a VNet-integrated Azure Perform as a proxy. Microsoft is actively engaged on injecting brokers straight into personal networks.
• Reminiscence is the multiplier. A principal engineer is extra beneficial than a junior engineer due to sample recognition. SRE Agent captures that sample recognition for the entire staff, each time it investigates.

The sample is straightforward, and Lee summarized it cleanly: you train the device, you make the connections, and it really works for you.

• Provision the agent. Go to sre.azure.com or the Azure portal, decide a subscription and useful resource group, decide a area, and stand it up. Takes a couple of minutes.
• Onboard it like a brand new engineer. Inform it about your staff, your workloads, and your procedures. Add runbooks, troubleshooting guides, wikis, and structure docs to the information base. If you happen to shouldn’t have these paperwork, ask the agent to draft them for you.
• Join your observability stack. Azure Monitor, Log Analytics, App Insights are wired in by default. Add third-party instruments via MCP connectors.
• Wire in your incident platform. Azure Monitor, PagerDuty, or ServiceNow. One agent per platform.
• Grant code entry. Join your GitHub or Azure DevOps repositories so the agent can purpose over software code, suggest fixes, and open pull requests.
• Choose your run mode. Begin in interactive mode when you construct belief. Transfer to approval-gated reactive mode. Graduate to autonomous mode on protected operations after you have the audit path you belief.

If you happen to discovered this convenient, the remainder of the Azure Infra Summit 2026 is full of classes on id, AKS, deployment, storage, networking, and resiliency. Seize the total playlist right here and binge what’s related to your stack:Microsoft Azure Infra Summit 2026

Massive because of Lee Oommen for strolling us via this. The three a.m. pager situation is one thing each one among us has lived, and seeing an agent take the primary hour of that incident off your plate is a tangible win.

Cheers!

Pierre Roman