From Alert to Resolved: Constructing a Self-Therapeutic Azure Platform with SRE Agent

Hiya People!

It’s 3 a.m. Your cellphone lights up. A vital workload that spans a number of clouds is on hearth, possession is fuzzy, the alert routed to the flawed staff first, and now it’s your drawback. You sit up in mattress, chilly and groggy, and begin the ritual. Open the runbook. Pull logs from one place. Pull metrics from one other. Stare at three dashboards. None of them inform the entire story. So that you construct a concept. The speculation is flawed. The clock retains ticking. The client influence retains climbing. Each flawed flip prices you time, context, and confidence.

That’s the scene Lee Oommen opened with at MAIS14, and it’s the purpose Azure SRE Agent exists. On this session, Lee walks by way of the 4 traditional SRE ache factors and exhibits how an agentic operations platform compresses MTTR from hours to minutes. I’m going to unpack what he confirmed, why it issues for IT execs, and find out how to get your palms on it.

When you carry a pager, write runbooks, or get pulled into post-mortems, this one is for you.

• The clock is the enemy, not the incident. Lee stated it plainly: there’s virtually all the time an professional who can repair the issue. The actual injury comes from the minutes spent discovering that professional and reconstructing context.
• Dashboards lie in each instructions. False positives create alert fatigue. False negatives let the shopper name you earlier than your screens do. Neither final result is suitable.
• RCAs take weeks as a result of the reply by no means lives in a single layer. Infrastructure, community, deployments, dependencies, databases, app code. You want somebody, or one thing, that may correlate throughout all of them in a single cross.
• You didn’t turn out to be an SRE to be a dashboard watcher. Toil is the work that holds again the individuals who ought to be designing reliability into the following technology of companies.

Let’s begin with what it’s not. It’s not a dashboard. It’s not a monitoring instrument. It’s not a chatbot.

Azure SRE Agent is an end-to-end agentic operations platform. Consider it as a senior SRE who sits inside your staff, works 24 by 7, by no means will get drained, by no means misses a sign, and is fluent in your stack.

• Causes over telemetry, not simply textual content. It pulls metrics, logs, traces, deployment historical past, and exercise logs, then correlates throughout them.
• Takes ruled actions. Each motion runs contained in the permission boundary you outline. You determine whether or not the agent proposes a repair, asks for approval, or acts autonomously.
• Authors RCAs in minutes, not weeks. It traces the foundation trigger in a single movement throughout your complete stack and produces the report instantly after remediation.
• Remembers. It captures organizational reminiscence from each incident, each chat, and each scheduled job, then applies it to the following investigation.

Lee referred to as it the operations half of DevOps, and that framing caught with me. We now have automated construct and deploy. The operations aspect has been caught in toil. SRE Agent closes that loop.

Lee demonstrated the total loop dwell. Here’s what it appears like finish to finish.

1. Detect. The agent integrates with Azure Monitor, PagerDuty, or ServiceNow. When an alert fires, the agent acknowledges it inside seconds. The human doesn’t need to get up chilly.
2. Examine. The agent runs diagnostics in parallel throughout the linked sources. It queries Log Analytics, App Insights, Azure Monitor metrics, and any third-party observability instruments you wired in by way of MCP connectors.
3. Correlate. It makes use of distributed tracing, cross-workspace KQL queries, and time-based sign alignment to attach dots throughout companies that don’t even share hint IDs. It additionally checks previous incidents in reminiscence to see if this appears acquainted.
4. Diagnose. It produces a root trigger evaluation with the related proof linked inline. No extra reconstruction train throughout a number of groups.
5. Suggest or Act. Primarily based in your run mode and the permissions granted, the agent both proposes a repair and waits for approval, or executes the remediation autonomously. Lee demonstrated each. He arrange a nasty slot swap on Azure App Service, generated HTTP 500 errors, watched the agent acknowledge the alert, examine, determine the unhealthy slot, ask for permission, after which carry out the slot swap to revive the service.
6. Shut the loop. The agent information a GitHub or Azure DevOps problem with full context, opens a pull request with proposed code modifications when applicable, and writes a session insights abstract you possibly can evaluation.

Three modes to work together with it:

• Interactive. Chat with the agent like a copilot. Most prospects begin right here to construct belief.
• Reactive. Occasion-driven. The agent reacts to incidents from Azure Monitor, PagerDuty, or ServiceNow. One agent per incident platform.
• Proactive. Scheduled duties that run each 5 minutes, each hour, day by day, or weekly. Certificates well being audits, well-architected framework assessments, price optimization sweeps, compliance checks. Lee confirmed a scheduled job that flagged a certificates expiring in 50 days earlier than it may ever hearth an alert.

That is the place the dialog will get sensible. A couple of issues from Lee’s demo and the dwell Q&A that I need to name out.

• Multi-cloud actuality. SRE Agent lives in Azure however will not be restricted to Azure. Customized runbooks, Python execution, MCP servers, and connectors let it orchestrate throughout AWS, GCP, and on-premises. Deal with it because the central SRE mind.
• Your information stays yours. Every agent will get a devoted information retailer in your subscription and useful resource group. Reminiscence, information, threads, and session insights dwell in your chosen area. Nothing is used to coach the mannequin supplier. Encryption at relaxation, TLS 1.2 in transit, Azure RBAC, managed identification, customer-managed keys all apply.
• Id boundary you already know. The agent makes use of normal Azure managed identification. Grant the identification RBAC on any cross-subscription useful resource it wants to achieve. Least privilege nonetheless applies.
• Area availability. At session time, brokers could be deployed in EastUS2, Sweden Central, and Australia East. The checklist is updating roughly month-to-month. Canada is coming. An agent in a single area can act on sources globally, however when you’ve got information residency guidelines, deploy the agent inside the identical jurisdiction.
• Non-public endpoints at the moment. In case your Log Analytics Workspace or databases are absolutely locked down behind personal endpoints with public entry disabled, the agent presently wants a VNet-integrated Azure Operate as a proxy. Microsoft is actively engaged on injecting brokers straight into personal networks.
• Reminiscence is the multiplier. A principal engineer is extra invaluable than a junior engineer due to sample recognition. SRE Agent captures that sample recognition for the entire staff, each time it investigates.

The sample is straightforward, and Lee summarized it cleanly: you train the instrument, you make the connections, and it really works for you.

• Provision the agent. Go to sre.azure.com or the Azure portal, decide a subscription and useful resource group, decide a area, and stand it up. Takes a couple of minutes.
• Onboard it like a brand new engineer. Inform it about your staff, your workloads, and your procedures. Add runbooks, troubleshooting guides, wikis, and structure docs to the information base. When you don’t have these paperwork, ask the agent to draft them for you.
• Join your observability stack. Azure Monitor, Log Analytics, App Insights are wired in by default. Add third-party instruments by way of MCP connectors.
• Wire in your incident platform. Azure Monitor, PagerDuty, or ServiceNow. One agent per platform.
• Grant code entry. Join your GitHub or Azure DevOps repositories so the agent can purpose over utility code, suggest fixes, and open pull requests.
• Choose your run mode. Begin in interactive mode when you construct belief. Transfer to approval-gated reactive mode. Graduate to autonomous mode on secure operations after you have the audit path you belief.

When you discovered this handy, the remainder of the Azure Infra Summit 2026 is filled with classes on identification, AKS, deployment, storage, networking, and resiliency. Seize the total playlist right here and binge what’s related to your stack:Microsoft Azure Infra Summit 2026

Huge because of Lee Oommen for strolling us by way of this. The three a.m. pager situation is one thing each considered one of us has lived, and seeing an agent take the primary hour of that incident off your plate is a tangible win.

Cheers!

Pierre Roman