Step 1: Create and Set Up Your Azure SRE Agent
Deploy an Azure SRE Agent, connect your code repository, and add Azure resource access.
What you'll accomplish
- Deploy an Azure SRE Agent to your subscription
- Connect a code repository
- Grant the agent access to the Azure scopes it should investigate
Prerequisites
| Requirement | Details |
|---|---|
| Azure subscription | An active Azure subscription with permission to create resources |
| Role | Contributor to create resources. You also need Owner or User Access Administrator on any scope where the portal must create role assignments, including Azure scopes you add during setup. |
| Repository access | An account, personal access token, managed identity, or GitHub App with access to the repository you want to connect |
| Network access | *.azuresre.ai must be reachable from your browser |
Open the onboarding wizard
- Navigate to sre.azure.com.
- Sign in with your Azure credentials.
- Select the Agents tab, then click Create agent.
The wizard has a three-step flow: Basics → Review → Deploy.
Basics
Fill in the fields to define your agent:
| Field | Description | Example |
|---|---|---|
| Subscription | The Azure subscription that will own the agent resource | My Production Subscription |
| Resource group | An existing resource group or create a new one | rg-sre-agent |
| Agent name | A unique name for your agent instance | contoso-sre-agent |
| Region | Azure region for deployment | East US 2 |
| Model provider | Choose the AI model provider for your agent | Varies by subscription and region |
| Application Insights | Create a new instance or use an existing one | Create new (default) |
After you select a region, the Model provider field appears. The available providers and default selection are loaded for your subscription and region. Options may include Microsoft Foundry, GitHub Copilot, and Anthropic, depending on availability and administrator policy.
The wizard identifies providers covered by EU Data Boundary (EUDB) commitments. Anthropic and GitHub Copilot are excluded from EUDB commitments in EUDB regions. Anthropic also requires a direct agreement and may be disabled by your administrator.
The wizard marks the default or preferred provider and shows its consumption multiplier when applicable. You can change the provider after creation in Settings → Basics. See Pricing and billing for cost details.
Click Next to proceed.
Checkpoint: All required fields are filled, including the model provider. The Next button is enabled.
Review
The wizard shows a summary of your configuration. Verify:
- Subscription and resource group are correct.
- Agent name and region match your intent.
Click Create to begin provisioning.
Checkpoint: The summary matches what you entered. No validation errors appear.
Deploy
The deployment creates the following Azure resources:
| Resource | Purpose |
|---|---|
| Managed Identity | Authenticates the agent to Azure services |
| Role assignments | Grants the current user access to administer the agent and grants the agent identity monitoring access |
| Azure SRE Agent resource | The agent itself |
| Application Insights and Log Analytics Workspace | Created only when you select Create new for Application Insights |
If you select an existing Application Insights resource, the deployment links it to the agent instead of creating new monitoring resources.
Wait for the deployment to complete. This typically takes 2–5 minutes.
Checkpoint: Deployment status shows Succeeded. Newly created resources are listed as created, and any existing Application Insights resource is linked to the agent.
Set up your agent
After deployment finishes, click Set up your agent to open the setup page. You'll see the header "More context. Better investigations." This page has two tabs:
| Tab | Data sources |
|---|---|
| Quickstart | Code, Logs, Azure Resources, Incidents |
| Full setup | Everything in Quickstart + Knowledge Files |
Start with the Quickstart tab. Not all sources are required — but connecting more gives your agent better context for investigations. This guide walks through connecting code, logs, and Azure resources.
Connect your code repository
- On the Code card, click the + button to connect repositories.
- In Choose a platform, select GitHub, Azure DevOps, or GitLab. For GitHub, enter
github.comor your GitHub Enterprise Cloud host. For Azure DevOps, enter the organization name. - In Authenticate, choose one of the methods offered for that platform:
- GitHub: Your account (when configured), PAT, or a bring-your-own GitHub App. GitHub Enterprise Cloud requires a GitHub App.
- Azure DevOps: Your account, managed identity, or PAT.
- GitLab: PAT.
- Click Next to open Add repositories.
- Select one or more repositories and provide the required display details.
- Click Save.
Checkpoint: The Code card shows a green checkmark and lists the connected repositories.
Connect the repository that contains the service you'll investigate first. Once connected, your agent immediately starts exploring the codebase and building expertise — learning your project structure, deployment configurations, and code patterns through Deep Context.
Connect your logs
Connecting log sources gives your agent access to production telemetry — error traces, performance metrics, and application health data. Combined with source code, this lets your agent correlate production issues with code changes during investigations.
The setup page marks Logs as Recommended and Best with code — connecting both gives your agent the full picture from day one.
- On the Logs card, click the + button.
- The Configure logging provider dialog opens with three steps.
- In Step 1: Choose a logging provider, select a log source:
| Log source | What it provides |
|---|---|
| Log Analytics Workspace | Query logs, discover tables, check activity logs, and monitor metrics across your Log Analytics workspaces. Read-only. |
| Application Insights | Query application telemetry, trace requests, analyze dependencies, and monitor performance metrics. Read-only. |
If you don't see the connector you need, use the search bar at the top of the dialog to find it. Additional log sources include Azure Data Explorer (Kusto), Datadog, Splunk, Elasticsearch, Dynatrace, and New Relic.
- Click Next to proceed to Step 2: Set up logging provider.
- Fill in the required fields:
| Field | Description |
|---|---|
| Name | A descriptive name for this connector (e.g., prod-logs) |
| Log Analytics Workspace or Application Insights | Select the resource from the dropdown — it lists resources from your Azure subscriptions |
| Managed Identity | Select an identity attached to the agent. The portal prefers a user-assigned managed identity and falls back to the system-assigned identity when no UAMI is available. |
- Click Next to review, then click Add connector.
Checkpoint: The Logs card shows a green checkmark and lists your connected log source.
Verify log access
Ask your agent about a recent issue:
Check for any errors in the last 24 hours
Your agent queries the connected log source and returns results.
The selected managed identity needs Log Analytics Reader and Monitoring Reader on the resource group containing the Log Analytics workspace or Application Insights resource. The portal attempts to assign missing roles and flags the connector if no effective role assignment is found. If role assignment fails, grant the roles in Azure and refresh the connector status.
You can add multiple log sources — for example, connect both a Log Analytics workspace for infrastructure logs and an Application Insights resource for application telemetry. For the full list of supported log sources and how your agent uses them during investigations, see Azure Observability and External Observability.
Add Azure resource access
Granting the agent access to your Azure resources allows it to query metrics, logs, and resource configurations during investigations. The permission level you choose determines which RBAC roles are assigned (see Permissions for details). Connector-specific roles like Log Analytics Reader and Monitoring Reader are handled separately during connector setup.
- On the Quickstart or Full setup tab, find the Azure Resources card.
- On the Azure Resources card, click the + button to add resources.
- Choose resource type: Select Management groups, Subscriptions, or Resource groups, then click Next.
If you chose Management groups:
- Select one or more management groups.
- Review the required permissions. The wizard grants missing Reader and Azure Monitor Monitoring Contributor roles at the management-group scope.
- Add the management groups.
If you chose Subscriptions:
- Select subscriptions: Use the search box to find subscriptions. Check the ones you want the agent to access.
- Click Next to review agent permissions.
- The wizard grants missing Reader and Azure Monitor Monitoring Contributor roles on each selected subscription. Review the permissions status.
- Click Add subscriptions.
If you chose Resource groups:
- Filter by subscription: Use the subscription dropdown to filter which resource groups are shown.
- Select resource groups: Use the search box to find resource groups. Check the ones you want the agent to access. The grid shows the resource group name, subscription, and region.
- Click Next to review agent permissions.
- Choose the permission level for the agent, and review the role assignments.
- Click Add resource group.
Checkpoint: The Azure Resources card shows the connected management groups, subscriptions, or resource groups.
Before adding a scope, the wizard checks the agent identity's effective role assignments and grants any required roles that are missing. Resource-group roles depend on the selected permission level and detected resource types. For advanced permission management, see Manage permissions and access.
Click "Done and go to agent"
Once you've connected your data sources, click Done and go to agent. This takes you into the agent chat to start team onboarding.
Checkpoint: The agent chat opens.
Related capabilities
| Capability | What it adds |
|---|---|
| Connectors | How the agent connects to external data sources |
| User Roles | Who can access your agent and what they can do |
| Permissions | How permission levels and RBAC roles work |