This is a blog post where I try to wrap up the content of my presentation this week at NIC (Nordic Infrastructure Conference) where I got to talk about Azure SRE Agent.
For those that are not familiar with Azure SRE Agent, it is really comparable to a Claude based managed agent running in Microsoft Azure, integrated with Azure skills, memory features and integrations to the different Azure services like Azure Monitor, Log Analytics and its own managed identity (but within its own harness) also made a nice picture below to showcase the different features and capabilties.
One thing to note is that SRE Agent runs either using Anthropic og OpenAI models, we cannot point inferencing to an AI gateway, so all inferencing traffic is managed by Microsoft. Now while one agent runs with its own managed identity, we also have the concept of sub-agents but they also share the same identity but can be configured either in review or autonomous mode.
When setting up a new agent (which is done within the SRE custom portal https://sre.azure.com) you only need to define a couple of things
•Location (not for LLM processing!)
•LLM Provider (Anthropic (Outside EU) / OpenAI (EU))
•Permissions (Review / Autonomous) and scope (MG, Sub, RG)
•Integrations( Monitoring source / Skills / Code / Knowledge / MCP)
•Instructions and sub-agents
Once this is done you enter the starting flow where the agent wants you to give it more context (Right now it has some limitations in terms of where it can get external documenation (Github, Azure DevOps Wiki or Gitlab or custom files)
Once you have given it some context and resources you are good to go. Once you are in the main portal you can just give it a prompt to get started.
You should also note that the agent can be deployed either with VNET integration, or with limited where you need to define what kind of outbound services it can communicate with or just unrestricted (which allows it to communicate with everything) you should note that the agent is still running in a sandbox enviroment.
While SRE has a lot of built-in skills and tooling we can of course extend it with our own skills (for instance we can point SRE Agent to a remote github repository and it will automatically sync all skills). You just need to follow the skills marketplace structure as it is within the documenation –> https://learn.microsoft.com/en-us/azure/sre-agent/plugin-marketplace
and custom remote MCP servers, which I will write a bit more about but this allows the agent to troubleshoot and manage resources outside of Azure. Such as you can see here where the agent has MCP Servers configured against Cloudflare and Microsoft Graph APIs and “Downforeverybodyorjustme”
So where can we use SRE Agent? (Before I go into showing it) well some of the use-cases we used it for was
•Troubleshooting and diagnostics (Help me verify why Bastion has stopped working)
•AIOps (Management of incidents and operations) (Incident à Agent à Fix)
•Just getting things done (Building, checking, verifying)
•Review best-pratices (WAF)
Just think about this as an digital sparring partner when it comes to IT-operations. Because when stuffs break and you are not sure where to look to troubleshoot something, this is actually a quite useful service.
So one scenario which I used this product for, is troubleshooting when a service stopped working. This service was hosted in AKS in combination with Cloudflare as the front-end because of DDoS protection capabilities. So users were greeted with a error page from Cloudflare which looked like this
So some quick and notes from what we checked before we asked SRE Agent. We also noticed that errors and alerts were being generated in Azure Monitor.
- Cloudflare –> Azure LB –> Traefik Ingress –> AKS Pod
- Every pod was running
- No issues with AKS
- No issues with LB or Traefik
- Spent a long time reviewing applications logs and readiness probes
- Operations team on vacation and some with limited AKS experience
So after some short troubleshooting in the logs, we asked SRE agent what was going on and it quickly pointed out where the issue was. The certificate on the ingress controller expired and did not automatically renew, and because of the strict mode in Cloudflare it would not proxy the traffic to the backend.
So the agent gave a proposed set of tasks and action points to fix the issue as well.
One of the nifty things about SRE Agent is the built-in memory feature so I can chat with it and say /remember once this thread was complete and it will create a memory file to store the information about this incident for the next time it might happen.
Anothier issue happened for the same customer a couple of months later where they hadde issues with AVD, then we had done some work adding different context and skills to the SRE agent to different tools and products that were being used by the customer. So what happened next was that AVD stopped working for a lot of their users. Where the users got a mix of temporary user profiles, FSLogix errors or just black screens trying to login to their AVD Desktop.
So we have SRE Agent a set of the symptoms, the documenation for the service was in Wiki and asked it to figure out what was going on. Luckily it figured out quickly that Storage was the culprit. The file storage account was at its limit which trigged the “chain of events”
So again SRE Agent gave me a list of actions and I just gave it permissions to fix it on its own.
Another cool thing is that SRE agent is also available trough the Azure MCP server, which means that you can trigger it from your own Claude Code instance. Which means that I can use Claude Code to trigger a troubleshooting session, close down my computer and then check the status once I get back again.
And one final thing is the incident response plan. If you have the agent integrated with Azure Monitor you can trigger tasks or events based upon incidents that are created. For instance I have this sub-agent which will be trigged if a filserver runs low on disk in Azure. The sub-agent is running autonomous and can go in and automatically “clean up” old files or resize the disk if that is needed.
So this feature is still fairly new in Azure context, so it still has some limitations that I would like to point out. Firstly is IaC (Automation) many of the capabilities/features of the agent requires custom APIs to deploy it using automation. You cannot control the LLM calls and models (hosted by Microsoft), Each agent only has its own identity (including sub-agents) and lastly the The portal for this makes me want to scratch my eyes out.
But overall it is actually a good product which I recommened that you give it a try.