/azure-sre-agent

Source Map (Authoritative Basis)

This map ties key guidance in this skill to authoritative sources.

GitHub Copilot Agent Skills

1. Agent skill concept, supported locations, and skill package shape:
   • https://docs.github.com/en/copilot/concepts/agents/about-agent-skills
   • https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/add-skills
   • https://code.visualstudio.com/docs/copilot/customization/agent-skills
2. Agent Skills specification, frontmatter constraints, progressive disclosure, and validation:
   • https://agentskills.io/specification
   • https://learn.microsoft.com/en-us/agent-framework/agents/skills
3. GitHub CLI skill validation/publishing preview:
   • https://cli.github.com/manual/gh_skill

Platform and Routing

1. Incident platform behavior, single active platform, quickstart behavior:
   • https://learn.microsoft.com/en-us/azure/sre-agent/incident-platforms
2. Response plan lifecycle, turn off/on, testing mode, quickstart overlap warning:
   • https://learn.microsoft.com/en-us/azure/sre-agent/incident-response-plans
3. Run mode semantics and permission interaction:
   • https://learn.microsoft.com/en-us/azure/sre-agent/run-modes

Scheduled Automation

1. Scheduled task controls (Draft the cron for me, Polish instructions, Max executions precedence):
   • https://learn.microsoft.com/en-us/azure/sre-agent/scheduled-tasks
2. Workflow design practices, Run task now, custom agent trigger model:
   • https://learn.microsoft.com/en-us/azure/sre-agent/workflow-automation
3. HTTP triggers, event-driven execution, auth model, and limits:
   • https://learn.microsoft.com/en-us/azure/sre-agent/http-triggers
4. HTTP trigger setup and pipeline integration tutorial:
   • https://learn.microsoft.com/en-us/azure/sre-agent/create-http-trigger
5. HTTP trigger behavior details used in this package (404 on disabled triggers, 250-turn cap, and auth troubleshooting):
   • https://learn.microsoft.com/en-us/azure/sre-agent/http-triggers

Custom Agents and Skills

1. Custom agent behavior, testing, tool assignment, knowledge base limits:
   • https://learn.microsoft.com/en-us/azure/sre-agent/sub-agents
2. Skill activation model and constraints:
   • https://learn.microsoft.com/en-us/azure/sre-agent/skills
3. Default-agent versus custom-agent tool/skill inheritance and override behavior:
   • https://learn.microsoft.com/en-us/azure/sre-agent/default-agent-override-info
4. Memory, session insights, synthesized knowledge, uploaded document formats, and knowledge base limits:
   • https://learn.microsoft.com/en-us/azure/sre-agent/memory
5. Code Interpreter sandbox, tool limits, timeout limits, and file-session behavior:
   • https://learn.microsoft.com/en-us/azure/sre-agent/code-interpreter

Connectors and MCP

1. Connector categories, health states, heartbeat behavior, wildcard syntax and version notes:
   • https://learn.microsoft.com/en-us/azure/sre-agent/connectors
2. MCP transport, partner connector behavior, authentication, preconfigured partners, and tool assignment:
   • https://learn.microsoft.com/en-us/azure/sre-agent/mcp-connectors
3. Managed connector operation governance, parameter locking, credential isolation, and Ask approval caveats:
   • https://learn.microsoft.com/azure/sre-agent/managed-connectors
   • https://learn.microsoft.com/azure/sre-agent/setup-managed-connector
4. SRE Agent MCP server for external tools calling into SRE Agent:
   • https://learn.microsoft.com/azure/sre-agent/mcp-server
5. investigate_yolo auto-approval behavior and MCP safety guardrails:
   • https://learn.microsoft.com/azure/sre-agent/mcp-server
6. Official plugin catalog and connector-specific setup guidance:
   • https://github.com/Azure/sre-agent-plugins

Governance with Hooks

1. Hook events (Stop, PostToolUse), formats, limits, best practices:
   • https://learn.microsoft.com/en-us/azure/sre-agent/agent-hooks
2. Hook API workflow and v2 extended-agent examples:
   • https://learn.microsoft.com/en-us/azure/sre-agent/tutorial-agent-hooks
3. Tool access policies (global/custom-agent/thread scopes; allow/ask/deny; hook-allow-overrides-deny interaction; toolGlob(argGlob) patterns):
   • https://learn.microsoft.com/en-us/azure/sre-agent/tool-access-policies

Real Deployment Patterns

1. Official end-to-end samples and labs:
   • https://github.com/microsoft/sre-agent
2. Hands-on lab post-provision and verification patterns (the repo moved samples/ into labs/; the hands-on lab is the labs/ root, azd up):
   • https://github.com/microsoft/sre-agent/tree/main/labs
3. Deployment-compliance sample (hooks + idempotent setup + policy workflows):
   • https://github.com/microsoft/sre-agent/tree/main/labs/deployment-compliance
4. Terraform drift detection sample (event-driven webhook flow + remediation patterns):
   • https://github.com/microsoft/sre-agent/tree/main/labs/terraform-drift-detection
5. Terraform drift operations reference blog:
   • https://techcommunity.microsoft.com/blog/appsonazureblog/event-driven-iac-operations-with-azure-sre-agent-terraform-drift-detection-via-h/4512233
6. Recipe templates used for incident-platform and PR deployment-guard parity:
   • https://github.com/microsoft/sre-agent/tree/main/sreagent-templates/recipes/dynatrace-servicenow
   • https://github.com/microsoft/sre-agent/tree/main/sreagent-templates/recipes/law-dynatrace-github-httptrigger-prvalidation
7. Recipe template used for VM + Cosmos workload parity:
   • https://github.com/microsoft/sre-agent/tree/main/sreagent-templates/recipes/pagerduty-law-vmcosmos
8. This skill's full-capability blueprint patterns:
   • references/production-blueprints.md
   • bundles/governance-kt/hooks/kt-completeness-gate.yaml
9. Bundle-first extension artifacts:
   • bundles/catalog.yaml
   • bundles/README.md
   • references/bundles-operations.md
   • references/capability-matrix.md

Observability and AMBA

1. Azure Monitor Baseline Alerts home and service-level alert recommendations:
   • https://azure.github.io/azure-monitor-baseline-alerts/
2. AMBA GitHub repository and releases:
   • https://github.com/Azure/azure-monitor-baseline-alerts
   • https://github.com/Azure/azure-monitor-baseline-alerts/releases
3. AMBA ALZ deployment and policy guidance:
   • https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/
   • https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/HowTo/deploy/Introduction-to-deploying-the-ALZ-Pattern/
   • https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/HowTo/deploy/Deploy-with-Terraform/
   • https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/HowTo/deploy/Remediate-Policies/
4. Example AMBA service pages used when seeding workload bundles:
   • https://azure.github.io/azure-monitor-baseline-alerts/services/App/containerApps/
   • https://azure.github.io/azure-monitor-baseline-alerts/services/KeyVault/vaults/
   • https://azure.github.io/azure-monitor-baseline-alerts/services/ApiManagement/service/
   • https://azure.github.io/azure-monitor-baseline-alerts/services/Web/serverFarms/
5. Azure SRE Agent action auditing in Application Insights customEvents:
   • https://learn.microsoft.com/azure/sre-agent/audit-agent-actions

Project Boundary and AI Resource Isolation

1. Document Intelligence managed identities and secure storage/private endpoint patterns:
   • https://learn.microsoft.com/en-us/azure/ai-services/document-intelligence/authentication/managed-identities?view=doc-intel-4.0.0
   • https://learn.microsoft.com/en-us/azure/ai-services/document-intelligence/authentication/managed-identities-secured-access?view=doc-intel-4.0.0
2. Azure AI Search RBAC and managed identity guidance:
   • https://learn.microsoft.com/en-us/azure/search/search-security-rbac
   • https://learn.microsoft.com/en-us/azure/search/search-security-enable-roles
   • https://learn.microsoft.com/en-us/azure/search/search-how-to-managed-identities

Source RCA, Security, and Value Tracking

1. Source-code connection and RCA behavior:
   • https://learn.microsoft.com/en-us/azure/sre-agent/connect-source-code
2. GitHub connector capabilities:
   • https://learn.microsoft.com/en-us/azure/sre-agent/github-connector
3. Security overview and defense-in-depth model:
   • https://learn.microsoft.com/en-us/azure/sre-agent/security-overview
4. Incident value tracking, success rate, average TTM, and Intent Met quality:
   • https://learn.microsoft.com/en-us/azure/sre-agent/track-incident-value

Pricing, Regions, and Model Provider

1. AAU billing model, always-on cost, token-based active flow, monthly allocation limit:
   • https://learn.microsoft.com/en-us/azure/sre-agent/pricing-billing
2. Supported regions - 18 as of 2026-08-25 (Australia East, Canada Central, Central US, East Asia, East US 2, France Central, Italy North, Japan East, Korea Central, North Central US, South Africa North, Southeast Asia, Spain Central, Sweden Central, UK South, West Central US, West US 2, West US 3):
   • https://learn.microsoft.com/en-us/azure/sre-agent/supported-regions
3. Model provider selection, EUDB guidance, and provider switching behavior:
   • https://learn.microsoft.com/en-us/azure/sre-agent/model-provider-selection
4. Billing model update announcement (token-based active flow, effective April 15, 2026):
   • https://techcommunity.microsoft.com/blog/appsonazureblog/an-update-to-the-active-flow-billing-model-for-azure-sre-agent/4507866
5. API reference, data-plane auth audience, RBAC roles, and agent endpoint shape:
   • https://learn.microsoft.com/azure/sre-agent/api-reference
   • Verified 2026-08-25: Microsoft.App/agents REST versions are 2026-01-01 (GA) and 2025-05-01-preview (provider default / page-pinned). Data-plane token audience is https://azuresre.dev; agent endpoint pattern https://{name}--{id}.{hash}.{region}.azuresre.ai. The HTTP-trigger Troubleshooting section says the audience must be the SRE Agent app ID 59f0a04a-b322-4310-adc9-39ac41e9631e (an ARM https://management.azure.com audience returns 401), while the API-reference section shows --resource https://management.azure.com; three conflicting audiences, keep marked [VERIFY]. actionConfiguration.mode is Review, Autonomous, or ReadOnly (Automatic is rejected; the API-reference page's Automatic enum is stale; live-verified 2026-08-10); actionConfiguration.accessLevel is Low or High; defaultModel.provider is Anthropic or MicrosoftFoundry; upgradeChannel is Stable or Preview. ARM also documents sub-resources for skills/subagents/tools/scheduledTasks/incidentFilters/hooks/commonPrompts (PUT/GET/DELETE; base64 envelope for non-connectors) plus data-plane threads/approvals/repos paths; see references/live-verified-operations.md path table. RBAC roles: SRE Agent Administrator/User/Reader. See references/run-posture-and-operational-levers.md.
6. Network requirements, required domains, resources created during provisioning, and regional availability pointer:
   • https://learn.microsoft.com/azure/sre-agent/network-requirements
7. Infrastructure-as-code deployment phases and data-plane configuration gaps:
   • https://learn.microsoft.com/azure/sre-agent/deploy-iac

GA Announcement and New Capabilities

1. GA announcement (March 10, 2026):
   • https://techcommunity.microsoft.com/blog/appsonazureblog/announcing-general-availability-for-the-azure-sre-agent/4500682
2. What's new in GA release:
   • https://techcommunity.microsoft.com/blog/appsonazureblog/whats-new-in-azure-sre-agent-in-the-ga-release/4500779
3. Plugin Marketplace and Skills:
   • https://learn.microsoft.com/en-us/azure/sre-agent/skills
4. MCP connectors (including pre-configured partners):
   • https://learn.microsoft.com/en-us/azure/sre-agent/mcp-connectors
5. Starter lab (azd-based deployment):
   • https://github.com/microsoft/sre-agent/tree/main/labs/starter-lab
6. Additional labs/recipes inventory (verified 2026-08-25; re-sweep on next run): labs/deployment-guard, labs/zava-learning, recipes/minimal, recipes/azuretoaws-sre-agent (AWS cross-cloud), top-level appendix/lab-instructions.md.

Build 2026 and Post-GA Capabilities

1. Build 2026 announcement (five enterprise releases: VNet integration preview, Managed Connectors preview, granular permissions, Private Plugin Marketplace, GitHub Enterprise/BYO GitHub App):
   • https://techcommunity.microsoft.com/blog/appsonazureblog/azure-sre-agent-at-microsoft-build-2026-bringing-agentic-operations-to-the-enter/4524669
2. GitHub connector (OAuth, PAT, BYO GitHub App; GitHub Enterprise Cloud requires BYO App):
   • https://learn.microsoft.com/en-us/azure/sre-agent/github-connector
3. Log Analytics and Application Insights connectors (native MCP-backed query tools):
   • https://techcommunity.microsoft.com/blog/appsonazureblog/new-in-azure-sre-agent-log-analytics-and-application-insights-connectors/4509649
4. Execute mitigations (built-in safety: delete/remove refused, az keyvault blocked, management locks respected, subscription GUID validation; AgentAzCliExecution audit event):
   • https://learn.microsoft.com/azure/sre-agent/execute-mitigations
5. Network requirements (allow-list domains, provisioning resources, Zscaler warning):
   • https://learn.microsoft.com/azure/sre-agent/network-requirements
6. Agent Playground (YAML diff preview and Accept-selected-fixes workflow ; re-verify current UX before quoting):
   • https://sre.azure.com/docs/capabilities/agent-playground
7. AWS DevOps Agent cross-cloud integration (out of scope for this Azure-greenfield skill; roadmap note):
   • https://techcommunity.microsoft.com/blog/appsonazureblog/announcing-aws-with-azure-sre-agent-cross-cloud-investigation-using-the-brand-ne/4507413
8. Terraform drift detection via HTTP triggers (reference workflow):
   • https://techcommunity.microsoft.com/blog/appsonazureblog/event-driven-iac-operations-with-azure-sre-agent-terraform-drift-detection-via-h/4512233

Official Resources

1. Product documentation: https://aka.ms/sreagent/docs
2. Self-paced labs: https://aka.ms/sreagent/lab
3. Technical videos: https://aka.ms/sreagent/youtube
4. Home page: https://www.azure.com/sreagent
5. X (Twitter): https://x.com/azuresreagent

Notes

1. Community references are optional context only.
2. Community proactive-skill reference reviewed for cadence ideas (non-authoritative):
   • https://github.com/ricmmartins/azure-sre-agent-skills
3. If a claim cannot be tied to the sources above, treat it as a local assumption and label it.
4. KT templates in this skill are derived from a user-provided workbook: KT_Templates.xlsx (SA QU/WORKSHEET, PA QU/WORKSHEET, DA QU/WORKSHEET, PPA QU/WORKSHEET).