Azure SRE Agent is Microsoft's AI agent for incident response: it watches your Azure Monitor signals, investigates alerts, and proposes or executes remediations against your resources. It went generally available in March 2026 and bills on a hybrid model — a fixed 4 Azure Automation Units (AAU) per agent-hour of "always-on" time, plus token-based charges whenever the agent is actively working an incident. At the illustrative rate of ~$0.10 per AAU, that's about $0.40/hour, or roughly $292/month per agent, before a single investigation runs (Microsoft Learn). It's worth adopting if your on-call rotation burns real human hours on triage of recurring, well-understood failures; it is not worth it if your incidents are mostly novel, cross-team, or compliance-gated.

What does Azure SRE Agent actually do?

Azure SRE Agent sits between your telemetry and your remediation surface. In practice it does four things:

• Ingests and triages alerts. It subscribes to Azure Monitor alerts, Application Insights signals, and resource health events, then correlates them rather than paging on each one individually.
• Investigates. It queries logs, metrics, recent deployments, and resource configuration to build a hypothesis about root cause — the same first 20 minutes a human on-call engineer spends before they know what they're dealing with.
• Proposes or executes remediation. Depending on the guardrails you configure, it can either write up a recommended action or take it: restart an app service, scale a plan, roll back a revision, adjust a configuration.
• Integrates with your existing incident tooling. It posts into your incident channel and ticketing flow rather than replacing it, so the human record of the incident stays where your team already looks.

Access is scoped through managed identity and Azure RBAC, which is the important architectural detail: the agent can only do what the identity you assign it can do. That's your primary control surface, and it's where evaluation should start — not with the feature list.

How much does Azure SRE Agent cost? The AAU math, worked through

Pricing has two independent components, and conflating them is the most common budgeting mistake.

Component 1 — always-on flow (fixed, time-based). Each agent bills 4 AAU per agent-hour simply for existing, regardless of whether it does anything (Azure pricing page). Using Microsoft's illustrative rate of $0.10 per AAU:

4 AAU/hour × $0.10/AAU        = $0.40 per agent-hour
$0.40 × 730 hours/month       = $292 per agent per month

Component 2 — active flow (variable, token-based). When the agent is actually investigating or remediating, you're billed on model token consumption at each provider's published AAU-per-million-tokens rate. This changed in April 2026: active flow was originally billed per second of agent work and moved to token-based metering (Microsoft Tech Community). That shift matters for forecasting — your variable cost now tracks investigation complexity, not wall-clock duration. A ten-minute investigation that reads 40 log queries costs more than a ten-minute investigation that reads three.

Worked example — a small platform team.

Say you run three agents: one for your production app tier, one for data/storage, one for networking and ingress.

The baseline is the number to plan around because it is fixed and unavoidable; the token component is the one to instrument and watch for the first 60 days. Two practical consequences:

1. Agent count is your biggest cost lever. Three agents cost 3× the floor whether or not two of them are idle. Start with one agent scoped to your noisiest service, prove value, then expand.
2. Compare against loaded engineer cost, not list price. $292/month is roughly 2–3 hours of a senior engineer's fully loaded time in most markets. If an agent removes more than three hours of triage toil per month, the baseline pays for itself — the honest question is whether the token component and review overhead stay below the rest of the savings.

When does Azure SRE Agent NOT replace your on-call runbook?

This is the section vendor documentation won't write for you. Three categories where a human stays in the loop:

1. Novel failure modes with no precedent in your telemetry. The agent reasons from signals it can see and patterns it has context for. A cascading failure caused by an upstream SaaS provider silently changing a rate limit, a subtle data-corruption bug that manifests as normal-looking latency, or a first-of-its-kind interaction between two services — these produce confident-sounding but wrong hypotheses. Keep the human runbook for anything where the alert doesn't match a shape you've seen before, and treat agent output on novel incidents as a lead, not a conclusion.

2. Actions requiring business judgment or cross-team authority. "Should we fail over to the secondary region?" is not a technical question when failover means 40 minutes of degraded writes during a payment processing window. Neither is "do we shed load from tenant A to protect tenant B?" The agent has no view of contractual SLAs, customer escalation history, or which VP is on a call with that customer right now. Any remediation that trades one stakeholder's availability against another's belongs to a human with authority.

3. Compliance-gated and change-controlled environments. If you operate under SOC 2, HIPAA, PCI DSS, or an internal change-advisory process, an autonomous production change may itself be the violation — regardless of whether it fixed the problem. In these environments, run the agent in propose-only mode and route its recommendations through your existing approval path. You still get the triage speedup; you don't get an audit finding.

A useful rule of thumb from rollouts we've run: let the agent execute where the action is idempotent, reversible, and scoped to a single service. Everything else is propose-only.

What is the Azure SRE Agent equivalent in AWS?

AWS DevOps Agent, which reached general availability on March 31, 2026 (AWS Cloud Operations Blog). It is built on Amazon Bedrock AgentCore and covers the same problem space: incident investigation, root-cause correlation across telemetry, code and deployment data, and on-demand SRE tasks.

For multi-cloud teams the practical differences are billing predictability and scope. Azure's fixed floor makes cost forecastable but charges for idle agents; AWS's per-second model has no idle floor but is harder to budget for a volatile incident month. AWS also positions DevOps Agent for multicloud and on-prem environments, while SRE Agent is Azure-centric — so if your Azure footprint is one of three, evaluate on coverage before you evaluate on price.

Running both is legitimate if each cloud carries a meaningful independent workload. Running both to hedge is how you end up paying two baselines for one outcome.

How should you evaluate and roll out Azure SRE Agent?

Our approach at Synchronized Codelab, for teams already running Azure infrastructure:

1. Baseline your toil first. Pull 90 days of incidents. Classify each as (a) recurring with a known runbook, (b) novel, (c) requiring judgment or approval. Only bucket (a) is addressable — if it's under 30% of your incidents, the agent's ROI case is thin.
2. Scope one agent, propose-only. Attach it to your noisiest bucket-(a) service. Give it a read-heavy managed identity. Run for 30 days and score its hypotheses against what your engineers actually found.
3. Instrument token cost from day one. Tag the agent's consumption and build a cost view before you scale agent count, so the variable component never surprises you.
4. Graduate specific actions to autonomous. Promote individual remediations — not the whole agent — once the accuracy record supports it, and keep the reversibility test.
5. Codify the boundary in IaC. The identity, RBAC scope, and guardrails belong in Terraform or Bicep alongside everything else, reviewed like any other privileged access change.

If you want a second set of eyes on the incident classification or the rollout guardrails, that's the kind of engagement we run — a short evaluation before a budget commitment, not a platform rebuild.

FAQ

How much does Azure SRE Agent cost per month?

About $292 per agent per month at baseline, derived from 4 AAU per agent-hour at an illustrative $0.10/AAU across 730 hours. That covers only the always-on flow. Active investigations add token-based charges on top, at each model provider's published AAU-per-million-tokens rate.

Is Azure SRE Agent generally available?

Yes. Azure SRE Agent reached general availability in March 2026, and its billing model was updated in April 2026 to move active-flow charges from per-second to token-based metering.

Can Azure SRE Agent make changes to production automatically?

It can, if you grant it a managed identity with the necessary RBAC permissions. Most teams should start in propose-only mode and graduate individual remediations to autonomous execution once accuracy is proven. Compliance-gated environments should generally keep it propose-only permanently.

What is the AWS equivalent of Azure SRE Agent?

AWS DevOps Agent, generally available since March 31, 2026 and built on Amazon Bedrock AgentCore. It handles incident investigation and SRE tasks across AWS, multicloud, and on-premises environments, and bills per second of operational work rather than on a fixed hourly floor.

Does Azure SRE Agent replace an on-call rotation?

No. It compresses triage time on recurring, well-understood failures. Novel failure modes, decisions requiring business judgment or cross-team authority, and change-controlled remediations still need a human on call.

How do you control Azure SRE Agent costs?

Limit agent count — each agent carries the full fixed baseline whether idle or busy — and scope agents to your highest-volume services rather than deploying one per resource group. Then tag and monitor token consumption during the first two months to establish a realistic active-flow forecast before scaling.