Frequently Asked Questions

Network and VNet integration

Do I need VNet integration to use the agent?

No. The SRE Agent works fully without VNet integration. In Unrestricted mode (the default), the agent investigates incidents, runs tools, queries Azure resources, and takes management actions over the public internet. Control plane operations (resource discovery, ARM calls, Azure Monitor metrics) work regardless of network configuration.

VNet integration is for organizations that need:

• Egress control — restrict where data can flow
• Private endpoint access — reach Log Analytics, AKS, Key Vault, or databases behind private endpoints
• Network-level audit trails — see agent traffic in your NSG flow logs and firewall logs
• Compliance — meet enterprise policies that require all workload traffic to route through controlled network paths

What can the agent do without VNet?

Everything that doesn't require access to private-network-only resources:

• Investigate incidents using publicly accessible Azure resources
• Run Azure CLI and kubectl commands against public endpoints
• Query Log Analytics and Application Insights (if public access is enabled)
• Connect to GitHub, Jira, Slack, and other SaaS services
• Create and manage scheduled tasks and response plans
• Use all connectors and MCP servers

When should I enable VNet?

Enable VNet integration when:

• Your Log Analytics workspaces, AKS clusters, or databases have public access disabled (behind AMPLS or private endpoints)
• Your security policy requires all outbound traffic from production workloads to pass through a firewall
• You need to reach on-premises systems (via ExpressRoute or VPN) during investigations
• Compliance requires network-level visibility into where the agent sends data

For setup instructions, see Configure Network Controls. For architecture details, see Network Controls.

Can I switch network modes on a running agent?

Yes. You can switch between Unrestricted, Limited, and Azure VNet modes at any time. Settings persist across mode changes. Once a VNet is connected, the other mode cards are disabled until you disconnect the VNet.