Azure SRE Agent governance reference

Facts an architecture or security review asks for: what the service creates, which identities and roles it uses, how egress is routed, the order in which authorisation controls are evaluated, what persists and where, what the telemetry contains, and how it is billed.

Identity, permissions and tool access policy come from the Microsoft Learn articles listed under sources, read on 14 September 2026. The rest comes from an architecture review draft of the same date, which drew on Microsoft release announcements and the product documentation at sre.azure.com. The service changes quickly and Microsoft's own pages disagree with each other in places, so the conflicts are listed near the end rather than smoothed over. Re-verify pricing, regions, and preview status before a figure is used to authorise spend or a production deployment.

Access control has three layers, and they are configured in different places:

Layer	Controls	Configured at
User roles	What people can do with the agent	Azure IAM on the agent resource
Run modes	Whether the agent asks before acting	Per response plan and per scheduled task
Agent permissions	What the agent can reach in Azure, with on-behalf-of as the fallback	RBAC roles on resource groups

For the portal walkthrough see Azure SRE Agent portal surfaces, for the lab build see Set up an Azure SRE Agent, and for the reasoning behind the controls, plus a diagram of how the whole service fits together, see About Azure SRE Agent in a governed estate.

Service status

Capability	Status
Core service	GA, March 2026
VNet egress integration	GA, around August 2026
Network audit and workspace inspect	GA
Tool access policies (allow, ask, deny)	GA
Agent hooks	GA
GitHub Enterprise and bring your own GitHub App	Preview
Managed connectors (SaaS catalogue)	Preview
Private Plugins Marketplace	Preview
Inbound private endpoint to the agent	Not supported

Resource model

The agent is an ARM resource of type Microsoft.App/agents. The runtime is built on the Azure Container Apps platform, which is why the VNet subnet must be delegated to Microsoft.App/environments.

Resource created at provisioning	Purpose
Microsoft.App/agents	The agent
User-assigned managed identity	The identity that holds the agent's RBAC
System-assigned managed identity	Internal infrastructure operations, and the default reader for Key Vault secrets such as a GitHub App private key
Application Insights	Agent actions, tool calls, model calls, approval decisions
Log Analytics workspace	Backing store for Application Insights

Two API surfaces:

• Control plane, ARM. Create, configure and delete the agent and its sub-resources. This is what Bicep and Terraform reach.
• Data plane, a per-agent hostname of the form https://<agent>.<region>.azuresre.ai. Chat, threads, repository connections, knowledge upload and hook configuration.

Regions

An agent lives in one region in one subscription, and the region cannot be changed after creation. It can manage resources in any region or subscription where its identity holds permissions.

Supported: Australia East, Canada Central, East US 2, France Central, Italy North, Korea Central, South Africa North, Southeast Asia, Sweden Central, UK South.

The subscription must be registered for the service. An empty region dropdown means it is not.

Execution boundaries

Component	Runs in	Role	Holds credentials
Agent reasoning	Microsoft-managed runtime	Processes messages, selects tools, builds responses	No
Tool execution	Per-agent sandbox, a micro VM	File operations, bash, code analysis, MCP tools	No, receives per-call tokens
Identity sidecar	Separate service	Issues and manages tokens	Yes, exclusively
Network proxy	Separate service	Validates and routes every outbound request	Injects tokens in transit

Isolation is per agent: dedicated sandbox, separate database, separate blob storage, its own proxy instance, its own managed identity. Sandbox placement respects regional boundaries; Microsoft's stated example is that East US 2 sandboxes stay within Central US, North Central US or Canada Central.

One tool call runs as a fresh process with only explicitly declared environment variables, and the whole process tree terminates when it finishes. Token lifetimes: managed identity tokens about an hour, OAuth tokens refreshed 20 minutes before expiry, action tokens single use, blob SAS tokens an hour with refresh 15 minutes early.

The code interpreter in the sandbox has bash, Python and roughly 700 preinstalled packages. Arbitrary runtime installation is not available; extra packages are pre-installed into the base disk image through Workspace configuration.

Identity

The agent's identities

Two managed identities are created with the agent.

Identity	What it is	What it is for
User-assigned managed identity	A standalone identity resource in the agent's resource group	The one you manage: assign RBAC roles to it, and select it in connector dropdowns
System-assigned managed identity	An internal identity used by the agent's infrastructure	Nothing you configure, it is managed automatically

The user-assigned identity appears in the resource group as an id-* resource, and its object (principal) ID is what role assignments use. Three ways to find it:

• Agent portal, Settings then Azure settings. The name is in the Managed Identity field, and Go to Identity opens it in the Azure portal.
• Azure portal, in the agent's resource group.
• Azure CLI, which queries the agent through the container apps resource type rather than Microsoft.App/agents:

az resource show --resource-group <RESOURCE_GROUP_NAME> --name <AGENT_NAME> --resource-type Microsoft.App/containerApps --query identity.userAssignedIdentities

Permission levels

Chosen at creation. The level decides which RBAC roles are assigned to the user-assigned identity on the resource groups you select.

Level	What it grants	Behaviour
Reader	Core monitoring roles plus resource-type-specific reader roles	Read-only diagnostics. Prompts for temporary elevation through on-behalf-of when it needs to act
Privileged	Core monitoring roles plus resource-type-specific contributor roles, chosen from the resource types detected in the managed resource groups, for example Container App Contributor where Container Apps are present	Takes approved actions directly

Four roles are assigned at either level.

Role	Scope	What it allows
Reader	Resource group	View resources and properties
Log Analytics Reader	Resource group	Query logs and workspaces
Monitoring Reader	Resource group	Access metrics and monitoring data
Monitoring Contributor	Subscription	Acknowledge and close Azure Monitor alerts, and update monitoring settings

With no resource groups assigned at creation, the identity has no permissions at all.

Permissions follow resource group membership. Adding a resource group to the agent's scope assigns the identity's roles to it; removing one revokes all access to it. Individual permissions cannot be removed, only whole resource groups.

az role assignment create --assignee <AGENT_MANAGED_IDENTITY_ID> --role Reader --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>

az role assignment create --assignee <AGENT_MANAGED_IDENTITY_ID> --role Reader --scope /subscriptions/<SUBSCRIPTION_ID>

az role assignment create --assignee <AGENT_MANAGED_IDENTITY_ID> --role Contributor --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>

Microsoft's guidance is Reader at subscription scope for read-only breadth, and specific roles at resource group scope for write access.

The permission flow (managed identity if it holds the role, on-behalf-of if it does not) applies to everything the agent does: interactive chat, incident threads, scheduled runs, and autonomous operation.

On-behalf-of elevation

When the managed identity lacks permission, the agent surfaces an approve prompt and executes under the approver's credentials, which it does not cache.

• Only SRE Agent Administrator role holders can authorise it.
• Personal Microsoft accounts can never authorise it, whatever role they hold. Work or school accounts only.
• It applies in both run modes. An action beyond the identity's permissions pauses even in autonomous mode, including during autonomous incident response.
• A user signed in with a personal account cannot authorise, so an administrator on a work or school account has to.

Human roles

Assigned through IAM on the agent resource. The user who creates the agent automatically receives SRE Agent Administrator.

Role	Can	Cannot
SRE Agent Reader	View threads, logs, incidents	Chat, request actions, modify anything
SRE Agent Standard User	Chat, run diagnostics, request actions, manage scheduled tasks, upload knowledge, add repository connectors	Approve actions, create custom agents, delete resources
SRE Agent Author	Create custom agents, author response plans, configure incident management	Chat, approve, upload knowledge, add repository connectors, create scheduled tasks
SRE Agent Administrator	Everything, including approvals, connectors, settings, deletion, on-behalf-of authorisation, hooks, network mode changes

What each role reaches, by area:

Area	Reader	Standard User	Author	Administrator
Chat	View threads	Send messages, start threads	View threads	Full access, approve actions, delete threads
Agent Canvas	View custom agents	View custom agents	Create, edit, delete custom agents	Create, edit, delete custom agents
Knowledge base	Browse documents	Browse and upload	Browse documents	Upload and delete
Code repository connectors	View connectors	View, add, edit	View connectors	Add, edit, delete
Response plans	View plans	View plans	Create, edit, delete	Create, edit, delete
Managed resources	View resources	View resources	View resources	Add, remove
Scheduled tasks	None	Create, edit, delete	None	Create, edit, delete
Settings	View settings	View settings	View settings	Modify settings, stop or delete the agent

Four behaviours that surprise people:

• Author alone cannot chat (no threads/write) and cannot add repositories or upload knowledge in the portal (no Microsoft.App/agents/memory/write). Assign Standard User alongside Author, or assign Administrator.
• The ARM extension paths Microsoft.App/agents/{agent}/repositories and Microsoft.App/agents/{agent}/githubAuths use extendedAgents permissions, which Author does include. The same operation can therefore succeed through ARM and fail in the portal for the same user.
• Azure Owner and Contributor are control-plane roles and do not grant SRE Agent data actions. A user with no SRE Agent role sees an Access Required screen, with a banner offering to auto-assign Administrator when they hold Owner or Contributor on the resource.
• Enforcement is in the backend, not the UI. An insufficient role returns a 403 that can have an empty body, and buttons are not consistently disabled beforehand. Check the SRE Agent role assignment before troubleshooting Key Vault, ARM or networking.

az role assignment create --assignee user@company.com --role "SRE Agent Administrator" --scope <agent-resource-id>

az resource show --resource-group <RESOURCE_GROUP_NAME> --name <AGENT_NAME> --resource-type Microsoft.App/agents --query id -o tsv

Connector identities

Connector	Identity
Azure resource operations (ARM, CLI, diagnostics)	User-assigned managed identity
Outlook, Teams	Managed identity plus a named human's OAuth token, stored in a connector resource
Azure Data Explorer (Kusto)	Managed identity, granted Viewer on the cluster. No OAuth sign-in
Azure DevOps	Managed identity, granted access to the organisation
GitHub (github.com)	OAuth sign-in. No managed identity is used for the connection itself
GitHub Enterprise Cloud	GitHub App installation token, private key in Key Vault
Custom MCP	Endpoint credentials you supply, optionally a managed identity for downstream Azure calls
Key Vault	User-assigned managed identity, falling back to system-assigned

For GitHub Enterprise Cloud (<tenant>.ghe.com), bring your own GitHub App is the only supported model; OAuth and personal access tokens are unavailable for those hosts. The App's private key sits in Key Vault as a PEM secret, the agent's identity holds Key Vault Secrets User, and installation tokens are minted at runtime. Using the unversioned secret URI picks up rotation automatically.

Network

Egress modes

Mode	Behaviour
Unrestricted (default)	Any internet endpoint reachable
Limited	Deny all outbound, allow an explicit wildcard host list
Azure VNet	All non-platform egress routes through a delegated subnet in your VNet

Settings persist across mode changes. Once a VNet is connected the other mode cards are disabled until it is disconnected.

Routing

Traffic	Path	Configurable
Log Analytics, Application Insights, AKS, databases, Key Vault	Your VNet	Yes, default
On-premises over ExpressRoute or VPN	Your VNet	Yes, if routes allow
Orchestration, model endpoints, telemetry	Microsoft-managed infra	No
Package registries (PyPI, npm, NuGet, apt)	Managed infra by toggle, or your VNet with FQDN rules	Yes
Code repositories (GitHub, GitHub Enterprise, Azure DevOps)	Managed infra by toggle, or your VNet with FQDN rules	Yes, per provider
Remote MCP servers	Managed infra by toggle, or your VNet	Yes
Additional hostnames	Managed infra for listed hosts	Yes
Connector traffic	Public internet	No
Inbound to the agent	Not supported	No

Subnet

• Size /27 or larger per the GA announcement. The Learn network article still says /28 minimum with /26 for larger fleets.
• Delegated to Microsoft.App/environments.
• Same region as the agent.
• Empty and dedicated.

Set under Settings, Workspace configuration, Networking.

Operator browser allowlist

Separate from agent egress. These need to be reachable over both HTTP and WebSocket from operator workstations.

Domain	Purpose
*.azuresre.ai	Agent portal, API, real-time chat
sre.azure.com	Agent management portal
portal.azure.com	Azure portal
api.applicationinsights.io	Application Insights query API
api.loganalytics.io	Log Analytics query API
api.loganalytics.azure.com	Log Analytics query API, Azure domain
*.ods.opinsights.azure.com	Log Analytics workspace ingestion
management.azure.com	Azure Resource Manager
login.microsoftonline.com	Entra ID authentication
*.login.microsoft.com	Entra ID regional endpoints

Zscaler and several corporate proxies block *.azuresre.ai by default. A blocked WebSocket presents as an unresponsive chat rather than an error.

When a destination is denied or unroutable, the agent reports the failure in its investigation output, for example a connection timeout to a Log Analytics workspace, and carries on with what it can reach.

Authorisation

Precedence

Evaluated in this order for every tool call.

Rung	Control	Behaviour
1, highest	Hooks	Scripts or LLM judges evaluate the call. Allow skips everything below. Deny blocks. A user-defined hook returning allow overrides tool access policies including a global deny; system hooks cannot. Overrides are audit-logged. Only administrators can create hooks.
2	Tool access policies	Allow, ask or deny by tool-name glob. Deny blocks. Allow skips default approval, even in Review mode.
3	Default approval	Connector ask settings and tools flagged RequiresApproval pause for a human.
4, lowest	Run mode	Review pauses for approval, Autonomous auto-approves.

Tool access policy scopes

Scope	Set by	Rules allowed	Covers
Global	Administrator	Allow, ask, deny	Every custom agent and conversation on the agent
Custom agent	Administrator or author	Allow only	Conversations for that custom agent
Thread	Any user	Allow only	One conversation

Only the global scope can deny. Narrower scopes widen access inside the global boundary and can never weaken a global deny.

Rules are evaluated in this order when the agent calls a tool:

1. Deny, global only. A match blocks the tool.
2. Allow, any scope. A match runs the tool immediately, even in Review mode.
3. Ask, global only. A match pauses for approval in Review mode, and auto-approves in Autonomous mode.
4. No match. Default behaviour applies.

Where a tool matches both allow and ask, allow wins, which is what makes a thread-level allow work as a temporary override for a tool the user has already validated.

Patterns are globs on tool names, with * as the wildcard, and toolGlob(argGlob) for tools that execute commands.

Pattern	Matches
RunAzCliWriteCommands	Any Azure CLI write command
bash(az * delete *)	Any az ... delete ... command through the bash and shell tools
RunKubectlReadCommand(kubectl get *)	Any kubectl get command
*	All tools

Tool names that accept argument patterns:

Tool name	What it runs
RunInTerminal	Terminal commands
RunShellCommand	Shell commands
RunAzCliReadCommands	Azure CLI read operations
RunAzCliWriteCommands	Azure CLI write operations
RunKubectlReadCommand	kubectl read operations
RunKubectlWriteCommand	kubectl write operations
ExecutePythonCode	Python scripts
RunPsqlReadCommand	PostgreSQL read queries
ValidatePsqlCommand	PostgreSQL command validation
GeneratePdfReport	PDF report generation

The aliases bash, shell and execute_bash expand to all command-string tools (Azure CLI, kubectl, shell) but not to Python or PDF tools, so Python patterns have to name ExecutePythonCode directly. Limit is 1,000 patterns per scope.

Global policies are set in the portal under Settings then Permissions, or through the data-plane API. The three endpoints:

curl -X PUT "https://<agent>/api/v2/agent/settings/global" -H "Content-Type: application/json" -d '{"permissions":{"allow":["RunAzCliReadCommands","RunKubectlReadCommand(kubectl get *)"],"ask":["RunKubectlWriteCommand(kubectl apply *)"],"deny":["bash(az * delete *)","RunKubectlWriteCommand(kubectl delete *)"]}}'

curl -X PUT "https://<agent>/api/v2/extendedAgent/<custom-agent>/permissions" -H "Content-Type: application/json" -d '{"allow":["RunKubectlWriteCommand(kubectl apply *)"]}'

curl -X PUT "https://<agent>/api/v2/threads/<thread-id>/permissions" -H "Content-Type: application/json" -d '{"allow":["RunKubectlWriteCommand(kubectl apply -f deploy.yaml)"]}'

How the four controls combine

Reading across: the leftmost control that has an opinion decides, and everything to its right is skipped.

Hook	Access policy	Connector or RequiresApproval	Run mode	Result
Allow	skipped	skipped	skipped	Executes immediately
Deny	skipped	skipped	skipped	Blocked
Ask	skipped	skipped	skipped	User approves
No policy	Deny	skipped	skipped	Blocked
No policy	Allow	skipped	skipped	Executes immediately
No policy	Ask	none	Review	User approves
No policy	Ask	none	Autonomous	Auto-approved
No policy	No match	Ask	Review	User approves
No policy	No match	Ask	Autonomous	Auto-approved
No policy	No match	No	Any	Executes

No policy means no hooks configured, or hooks with no opinion on this tool. No match means no access policy rule covered it.

Run modes

Review proposes and waits. Autonomous executes and reports.

Modes are set per response plan and per scheduled task; the agent-level setting applies only when nothing more specific does. Response plans and scheduled tasks default to Autonomous. The agent-level default is Review.

Review mode shows approve and deny for Azure infrastructure operations, meaning CLI, ARM and equivalent writes. Sending email, posting to Teams and querying external data sources proceed without that prompt.

Hooks

Events: Stop, fired when the agent is about to return a final response, and PostToolUse, fired after a tool finishes successfully. Hooks run at agent level and custom-agent level, and both fire when both match, agent level first.

Two implementations: a prompt hook where an LLM returns a JSON decision, and a command hook running bash or Python in the sandbox.

Limits: 64 KB scripts, timeout 1 to 300 seconds, failMode of allow or block, and a rejection cap of 1 to 25 (default 3) for prompt Stop hooks. A Stop hook that rejects without a reason is treated as approval.

hooks:
  PostToolUse:
    - type: command
      matcher: "Bash|ExecuteShellCommand"
      timeout: 30
      failMode: block
      script: |
        #!/usr/bin/env python3
        import sys, json, re
        context = json.load(sys.stdin)
        command = context.get('tool_input', {}).get('command', '')
        dangerous = [r'\brm\s+-rf\b', r'\bsudo\b', r'\bchmod\s+777\b']
        for pattern in dangerous:
            if re.search(pattern, command):
                print(json.dumps({"decision": "block", "reason": f"Blocked: {pattern}"}))
                sys.exit(0)
        print(json.dumps({"decision": "allow"}))

Data

What persists

Raw query results are not written to a separate store. Chat and tool messages, including result summaries and excerpts, are serialised into the conversation thread.

Data	Storage	Retention
Conversation threads	Per-agent database	Until manually deleted
Session insights	Database and blob	Persistent
Memory files	Blob	Persistent across sessions
Thread files	Blob	Tied to the thread

There is no automatic expiry on threads, and no documented customer-managed key support for the agent's own stores.

Residency

• Content and conversation history are stored in the agent's region, wherever the managed resources are.
• Inference may occur outside the agent's region, for both Anthropic and Azure OpenAI models.
• For agents inside the EU Data Boundary using Azure OpenAI, inference stays within that boundary.
• Anthropic models are not covered by EU Data Boundary commitments. Prompts, responses and resource analysis may be processed in the United States.
• Anthropic is the default provider in most commercial regions. Azure OpenAI is the default in the EU, EFTA and UK, where Anthropic is opt-in with an explicit acknowledgement.
• Anthropic is unavailable in government clouds (GCC, GCC High, DoD) and sovereign clouds.
• Anthropic operates as a non-Microsoft provider managed by Microsoft, under the Microsoft Product Terms and DPA.
• Neither Microsoft nor Anthropic uses the data to train models, and data is isolated by tenant and subscription.

Encryption at rest is Azure-managed, and external communication is HTTPS.

Telemetry

Nine custom event types land in the customEvents table of the agent's Application Insights instance.

Event	Captures	Volume
AgentToolExecution	Every tool call: name, input, output, invoking sub-agent	High
ModelGeneration	Every model call: input and output tokens, model ID, thread	High
AgentResponse	Chat responses returned to a user	High
AgentExecution	Session start and end	Medium
MetaAgent	Routing and orchestration decisions	Medium
AgentHandoff	Cross-agent handoffs	Medium
AgentAzCliExecution	Azure CLI commands the agent ran	Low
IncidentActivitySnapshot	Incident lifecycle and outcome	Low
ApprovalDecision	A human approving or rejecting an action	Low

Present on every event: gen_ai.agent.id, gen_ai.agent.name, TraceId, SpanId, ParentSpanId, ThreadId, LogTimestamp, CorrelationId. TraceId follows one request from input through every tool call to the final response; ThreadId groups a whole conversation or incident.

Fields worth knowing by name:

Event	Field	Meaning
AgentToolExecution	EventType	ToolStart or ToolEnd, paired on CallId
	ToolName	For example RunAzCliWriteCommands, SearchResource
	ToolInput	The arguments, including the actual command text
	ToolOutput	The result, on ToolEnd
	SubAgentName	Which agent invoked it
IncidentActivitySnapshot	IncidentPlatform	PagerDuty, ServiceNow, Azure Monitor
	IncidentMitigatedByAgent	True if the agent resolved it
	IncidentAssistedByAgent	True if it helped without resolving
	AgentAutonomyLevel	autonomous or review
	ResponsePlanId, ResponsePlanCustom	Which plan handled it
	IncidentCreatedOn, IncidentHandledOn, IncidentMitigatedOn	The three timestamps MTTR comes from
ModelGeneration	EventType	ModelGenerationStart, End or Error
	ModelId	Which model served the call
	InputTokens, OutputTokens	Token counts behind cost attribution

ToolInput and ToolOutput carry real command text and real query results, so the workspace inherits the classification of the most sensitive system the agent can read. The workspace created at provisioning keeps whatever default retention it lands with.

Example, every write-class action in the last week:

customEvents
| where name in ("AgentToolExecution", "AgentAzCliExecution")
| where tostring(customDimensions.EventType) == "ToolStart"
| where tostring(customDimensions.ToolName) has_any ("Write", "AzCli", "Kubectl", "Terminal", "Shell", "Python")
| where timestamp > ago(7d)
| project timestamp,
    Tool    = tostring(customDimensions.ToolName),
    Command = tostring(customDimensions.ToolInput),
    Agent   = tostring(customDimensions.SubAgentName),
    Thread  = tostring(customDimensions.ThreadId),
    Trace   = tostring(customDimensions.TraceId)
| sort by timestamp desc

Example, anything that ran unsupervised in the last month:

customEvents
| where name == "IncidentActivitySnapshot"
| where timestamp > ago(30d)
| where tostring(customDimensions.AgentAutonomyLevel) == "autonomous"
| summarize Incidents = count(),
            Mitigated = countif(tostring(customDimensions.IncidentMitigatedByAgent) == "True")
          by Plan = tostring(customDimensions.ResponsePlanId),
             Service = tostring(customDimensions.IncidentImpactedService)
| sort by Incidents desc

Example, token burn by agent and model:

customEvents
| where name == "ModelGeneration"
| where tostring(customDimensions.EventType) == "ModelGenerationEnd"
| where timestamp > ago(30d)
| extend Agent  = tostring(customDimensions.AgentName),
         Model  = tostring(customDimensions.ModelId),
         InTok  = toint(customDimensions.InputTokens),
         OutTok = toint(customDimensions.OutputTokens)
| summarize Calls = count(), Input = sum(InTok), Output = sum(OutTok)
          by Agent, Model, Day = bin(timestamp, 1d)
| sort by Day desc, Output desc

Deployment

Prerequisites:

• Microsoft.App resource provider registered on the subscription.
• Owner, or Contributor plus User Access Administrator, on the subscription, because role assignment needs Microsoft.Authorization/roleAssignments/write.
• Owner or User Access Administrator on every resource group assigned to the agent.
• The subscription registered for the service in a supported region.
• *.azuresre.ai reachable from operator workstations, WebSockets included.
• For VNet mode, an empty dedicated delegated subnet in the agent's region.

Microsoft publishes templates in the microsoft/sre-agent repository with four backends, Bicep by default, Terraform through the azapi provider, PowerShell, and azd, all driving one config directory and all supporting --what-if or --dry-run.

Deployment runs in two phases:

Phase	Mechanism	Covers
Infrastructure	ARM, through Bicep or Terraform	Resource group, managed identity, Log Analytics, Application Insights, the agent, RBAC assignments, connectors, skills, subagents, tools
Data plane	apply-extras.sh against *.azuresre.ai	Code repositories, hooks, HTTP triggers, knowledge files, plugin configuration

Hooks are data-plane objects, not ARM sub-resources. If the pipeline runner cannot get a data-plane token (az login --scope "https://azuresre.dev/.default"), the script skips them and prints what it missed.

The template CLI also provides export (config directory from a running agent), clone (export and redeploy under a new name), diff (local config against the live agent), and verify (a 22-point check across connectors, skills, subagents and hooks).

Cost

Billing is in Azure agent units (AAU), a unit shared with other prebuilt Azure agents, with two components.

Always-on flow: 4 AAU per agent-hour, charged from creation until deletion. Stopping an agent does not stop it.

Active flow: token-based since 15 April 2026, metered across four token types at per-model rates. The earlier 0.25 AAU per second model is superseded.

Model	Input	Output	Cache read	Cache write
Claude Opus 4.6	100	500	10	125
GPT 5.3 Codex	35	280	3.5	0
GPT 5.2	35	280	3.5	0

Rates are AAU per 1M tokens.

Microsoft's published per-task figures:

Scenario	Tokens (in / out / cache read / cache write)	Opus 4.6	GPT 5.3 Codex
Quick question	20K / 2K / 15K / 5K	about 3.8 AAU	about 1.3 AAU
Incident investigation	200K / 15K / 150K / 50K	about 35.3 AAU	about 11.7 AAU
Full remediation	500K / 40K / 400K / 100K	about 86.5 AAU	about 30.1 AAU

Microsoft's worked example assumes roughly 0.10 USD per AAU, and a Japanese regional figure from April 2026 of about 16.0 JPY per AAU is consistent with it. The unit price varies by region and Microsoft may revise it, so the pricing calculator is the only number to budget against.

Controls and adjacent charges:

• Monthly AAU allocation limit per agent, minimum 500, maximum 1,000,000, set under Settings, Agent consumption. Increases take effect immediately, decreases next month.
• Time spent waiting for a human approval is not billed as active flow.
• Incident filters on response plans limit what the agent investigates at all.
• Azure Monitor ingestion driven by agent queries, third-party integration costs, and data egress are billed separately and are not part of AAU.

Constraints

Area	Constraint
Hosting	The reasoning runtime and the per-agent sandbox run on Microsoft-managed infrastructure, not in the customer subscription. Only the agent ARM resource, its identity, and its Application Insights and Log Analytics resources live in the tenant
Hosting	Sandbox placement respects regional boundaries but not the agent's own region. Microsoft's stated example places East US 2 sandboxes in Central US, North Central US or Canada Central
Lifecycle	Sandbox image, runtime version and patch cadence are not customer-managed. The templates expose an upgradeChannel property and nothing finer
Network	VNet integration is egress only; no inbound private endpoint to the agent
Network	Connector traffic does not route through the VNet
Network	Platform traffic (orchestration, model, telemetry) is never configurable
Network	Network audit covers egress-policy decisions only
Identity	Permissions are revocable only by whole resource group
Identity	Personal Microsoft accounts cannot authorise on-behalf-of
Identity	Author role cannot chat or add repositories in the portal
Authorisation	User-defined hooks can override a global deny
Authorisation	Review mode gates Azure infrastructure operations only
Deployment	Hooks and repositories are data-plane only, not ARM sub-resources
Deployment	Region is immutable, and one agent covers one region
Runtime	About 700 preinstalled packages, no arbitrary runtime install
Runtime	NuGet preinstalls must be .NET CLI tools, not libraries
Data	No documented customer-managed key support for the agent's stores
Data	Thread retention is until manually deleted
Data	Anthropic sits outside the EU Data Boundary and is unavailable in government and sovereign clouds
Availability	Ten regions, subscription registration required
Cost	Stopping an agent does not stop always-on billing
Cost	Hitting the AAU limit makes the agent unavailable for the rest of the month

Known documentation conflicts

Topic	Conflict	Value used here
VNet subnet size	The Learn network article says /28 minimum; the GA announcement says /27 or larger	/27 minimum
VNet maturity	The Learn network article is still titled preview; the August 2026 announcement declares GA	GA, with the preview-era limitations assumed to hold until restated
Region count	The general FAQ lists three regions; the regions reference lists ten	The list of ten
Active flow metering	The 2026 billing announcement describes 0.25 AAU per second; the pricing and billing article describes token metering from 15 April 2026	Token metering
Private Log Analytics access	The February 2026 blog says the agent runs outside your VNet and needs an Azure Function proxy; the network integration article and the GA announcement say VNet mode reaches private endpoints directly	VNet mode, with the proxy pattern still valid for non-VNet and cross-subscription cases

Sources

Microsoft Learn, read 14 September 2026:

• User roles and permissions, for the four built-in roles, the per-area access matrix, the Author role gaps, the ARM extension paths, and portal enforcement behaviour.
• Agent permissions, for permission levels, the four preconfigured roles and their scopes, the role assignment commands, and the on-behalf-of constraints.
• Agent identity, for the two managed identities, connector authentication, and how to find the user-assigned identity.
• Tool access policies, for the three scopes, evaluation order, pattern syntax, tool names, the control-combination matrix, the API endpoints, and the 1,000 pattern limit.

Everything else (regions, execution boundaries, egress routing, data residency, telemetry events, pricing, constraints) comes from the architecture review draft of 14 September 2026 summarised in About Azure SRE Agent in a governed estate, which cites Microsoft Learn, sre.azure.com and Microsoft announcements in turn. Deployment as code is in Azure SRE Agent Terraform reference.