You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
See every tool and skill your agent has, including built-in, custom, and MCP tools plus system and custom skills, organized by category. Toggle capabilities on or off at the space level, and changes apply across all agents instantly.
16
+
17
+
Agents created before March 10, 2026 require workspace tools to be enabled. For older agents, enable **EnableWorkspaceTools** in **Capabilities > Experimental Settings**.
18
+
19
+
> [!TIP]
20
+
> -**See every tool and skill**, including built-in, custom, and MCP tools plus system and custom skills, organized by category
21
+
> -**Toggle on or off** at the space level. Changes apply across all agents instantly.
22
+
> -**Smart defaults**: Both PagerDuty and ServiceNow incident management skills are enabled out of the box
23
+
> -**Inherited counts on canvas**: Each agent card shows how many global tools and skills it inherits
24
+
25
+
## Tools
26
+
27
+
The **Tools** page organizes your agent's tools into three tabs:
28
+
29
+
| Tab | What it shows |
30
+
|-----|---------------|
31
+
|**Built-in tools**| Platform-provided capabilities grouped by category: Core, Azure Operation, DevOps, Diagnostics, Incident Management, Knowledge Base, Log Query, and more |
32
+
|**MCP servers + services**| Tools from your connected MCP server connectors |
33
+
|**Custom tools**| User-defined tools created through Kusto tool creation, Python tool creation, or extended agent YAML |
34
+
35
+
Each tool shows its name and description with a checkbox to toggle it on or off. **Core tools** (like CreateFile, FileSearch, and GrepSearch) are always enabled and can't be disabled.
36
+
37
+
## Skills
38
+
39
+
The **Skills** page organizes your agent's domain expertise into two tabs:
40
+
41
+
| Tab | What it shows |
42
+
|-----|---------------|
43
+
|**Built-in skills**| System-provided skills grouped by domain: Core skills (always enabled), plus skills for Azure diagnostics, incident management, and more |
44
+
|**Custom skills**| Skills you create through the Skill Builder or extended agent YAML |
45
+
46
+
### Environment-aware defaults
47
+
48
+
| Default incident skills | Status |
49
+
|------------------------|--------|
50
+
|**PagerDuty incident management**| Enabled by default |
51
+
|**ServiceNow incident management**| Enabled by default |
52
+
53
+
### Making changes
54
+
55
+
1.**Browse** tools across tabs. Expand categories to see individual items.
56
+
1.**Search** using the search box to find specific tools or skills by name.
57
+
1.**Toggle** individual items, entire categories, or all items by using the checkboxes.
58
+
1.**Save changes** to apply your configuration.
59
+
1.**Reset to default** to restore all tools and skills to platform defaults.
60
+
61
+
### Inherited tools on the agent canvas
62
+
63
+
When you configure tools and skills on this page, every custom agent that doesn't have its own tool overrides automatically inherits your configuration. Agent cards display:
64
+
65
+
| Card state | What it shows |
66
+
|-----------|---------------|
67
+
|**Inherited**| "Inherits N tools, M skills" as a clickable link |
68
+
|**Custom**| "Tools, N," badge |
69
+
70
+
## How tools are managed at each level
71
+
72
+
| Level | Feature | What it controls |
73
+
|-------|---------|-----------------|
74
+
|**What tools exist**|[Deep context](workspace-tools.md)| The underlying capabilities, including file operations, terminal, Python, and Azure CLI |
75
+
|**Space-wide on/off**|**Tools page** (this page) | Which tools are enabled or disabled for the entire space |
76
+
|**Per-subagent**| Subagent tool configuration | Which specific tools each subagent can use |
# Tutorial: Manage global tools in Azure SRE Agent
14
+
15
+
Learn how to browse, toggle, and manage tools at the space level by using the Tools page.
16
+
17
+
> [!IMPORTANT]
18
+
> Agents created before March 10, 2026, require workspace tools to be enabled. For older agents, enable **EnableWorkspaceTools** in **Capabilities > Experimental Settings**.
19
+
20
+
**Time**: 5-10 minutes
21
+
22
+
## Prerequisites
23
+
24
+
- An active SRE Agent
25
+
- Contributor or higher role on the agent resource
26
+
27
+
## Step 1: Go to the Tools page
28
+
29
+
In the left sidebar, expand **Capabilities** and select **Tools**.
30
+
31
+
The page opens with three tabs: **Built-in tools** (selected by default), **MCP servers + services**, and **Custom tools**. A search box at the top filters tools within the active tab.
32
+
33
+
**Checkpoint:** You see a page titled "Tools" with the description "Tools are the capabilities available to your agent for investigating and resolving incidents."
34
+
35
+
## Step 2: Browse built-in tools
36
+
37
+
The **Built-in tools** tab organizes tools into expandable categories. Each category header shows a count of active tools (for example, "4/4 tools" means all four tools in that category are enabled).
38
+
39
+
Select a category to expand it and see individual tools with their descriptions.
40
+
41
+
The **Core** category has grayed-out checkboxes because core tools are always enabled and can't be disabled.
42
+
43
+
**Checkpoint:** You can expand categories and see tool names with descriptions.
44
+
45
+
## Step 3: Toggle a built-in tool
46
+
47
+
Find a non-core tool and clear its checkbox to disable it. A footer bar appears with three buttons:
48
+
49
+
-**Save changes**: Persist your configuration.
50
+
-**Undo changes**: Revert to the last saved state.
51
+
-**Reset to default**: Restore all tools to platform defaults.
52
+
53
+
Select **Save changes** to apply your configuration.
54
+
55
+
**Checkpoint:** After saving, the tool's active count updates in the category header.
56
+
57
+
## Step 4: Search for a tool
58
+
59
+
Type a tool name or keyword in the search box (for example, "query" or "deploy"). The list filters in real time to show only matching tools across all categories.
60
+
61
+
**Checkpoint:** Only tools matching your search term are visible.
62
+
63
+
## Step 5: Explore MCP server tools
64
+
65
+
Select the **MCP servers + services** tab.
66
+
67
+
This tab shows tools provided by your connected MCP connectors. If you don't configure any MCP connectors, you see "No MCP servers + services found."
68
+
69
+
**Checkpoint:** The MCP tab shows tools from configured connectors, or an empty state if none exist.
70
+
71
+
## Step 6: View custom tools
72
+
73
+
Select the **Custom tools** tab.
74
+
75
+
Create custom tools through Kusto tool creation, Python tool creation, or extended agent YAML configurations. Once created, custom tools appear here automatically.
76
+
77
+
**Checkpoint:** The Custom tab shows user-defined tools, or an empty state if none exist.
78
+
79
+
## Step 7: Reset to defaults
80
+
81
+
To undo all tool configuration changes, select **Reset to default** in the footer bar. A confirmation dialog appears. Select **Confirm** to revert all tool toggles to their platform defaults.
82
+
83
+
**Checkpoint:** All tool active counts return to their default values.
<!-- Video: SRE_Agent__User_Roles.mp4 — Replace with the hosted video URL using > [!VIDEO https://...] syntax -->
16
15
17
-
Your agent can investigate problems, take actions on production infrastructure, and access sensitive data across your environment. Access control determines who can request actions, who can approve them, and who can modify the agent's configuration.
16
+
Your agent can investigate issues, take actions on production infrastructure, and access sensitive data across your environment. Access control determines who can request actions, who can approve them, and who can modify the agent's configuration.
18
17
19
18
## Access control overview
20
19
21
-
Access control works across three layers.
22
-
23
-
:::image type="content" source="media/user-roles/access-control-hierarchy.svg" alt-text="Diagram of access control hierarchy showing user roles, run modes, and agent permissions." lightbox="media/user-roles/access-control-hierarchy.svg":::
20
+
Access control works across three layers:
24
21
25
22
| Layer | Controls | Configured at |
26
-
|---|---|---|
27
-
|**User roles** (this article) | What *users* can do with the agent | Azure IAM on the agent resource |
23
+
|-------|----------|---------------|
24
+
|**User roles** (this page) | What *users* can do with the agent | Azure IAM on the agent resource |
28
25
|**[Run modes](run-modes.md)**| Whether the agent asks before acting | Per response plan and per scheduled task |
29
-
|**[Agent permissions](permissions.md)**| What *the agent* can access on Azure, which includes managed identity RBAC roles and on-behalf-of fallback | RBAC roles on resource groups |
30
-
31
-
## Layer 1: User roles
26
+
|**[Agent permissions](permissions.md)**| What *the agent* can access on Azure | RBAC roles on resource groups |
32
27
33
-
Your agent includes three built-in Azure RBAC roles.
:::image type="content" source="media/user-roles/portal-sre-agent-roles-identity-access.png" alt-text="Screenshot of SRE Agent roles in Azure portal IAM showing Administrator, Reader, and Standard User." lightbox="media/user-roles/portal-sre-agent-roles-identity-access.png":::
36
+
The user who creates the agent automatically receives the **SRE Agent Administrator** role.
44
37
45
-
## Who should have which role
46
-
47
-
Use the following guidance to assign roles based on team responsibilities.
38
+
## Who should have which role?
48
39
49
40
| Role | Give to |
50
-
|---|---|
41
+
|------|---------|
51
42
|**SRE Agent Reader**| Auditors, compliance teams, stakeholders who need visibility |
52
-
|**SRE Agent Standard User**| L1/L2 engineers, first responders, anyone who diagnoses problems|
43
+
|**SRE Agent Standard User**| L1/L2 engineers, first responders, anyone who diagnoses issues|
The portal checks your Azure role assignments when you access the agent. The portal enforces access at two levels.
48
+
The portal checks your Azure role assignments when you access the agent. Access is enforced at two levels.
58
49
59
-
### Level 1: No agent access
50
+
### No agent access
60
51
61
-
When you don't have the SRE Agent role assignment, the portal shows an **Access Required** screen with a shield icon and a **Go to Access Control** button that opens the Azure IAM window. If you have Azure Owner or Contributor on the resource, you also see a banner offering to autoassign the Administrator role.
52
+
When you have no SRE Agent role assignment, the portal shows an **Access Required** screen with a shield icon and a **Go to Access Control** button that opens the Azure IAM blade. If you have Azure Owner or Contributor on the resource, you also see a banner offering to auto-assign the Administrator role.
62
53
63
-
### Level 2: Backend enforcement
54
+
### Backend enforcement
64
55
65
-
When you have an SRE Agent role but attempt an action beyond your permissions, the backend blocks the action with a 403 error. The portal might let you navigate to a page or select a button, but the operation fails with a permission error when it reaches the server.
56
+
When you have an SRE Agent role but attempt an action beyond your permissions, the **backend blocks the action with a 403 error**. The portal might let you navigate to a page or select a button, but the operation fails with a permission error when it reaches the server.
66
57
67
58
> [!NOTE]
68
-
> Some portal features proactively disable buttons when you lack write permissions (for example, connector management shows disabled buttons with tooltips). However, this behavior isn't yet consistent across all features. The backend always enforces the correct permissions regardless of what the UI shows.
59
+
> Some portal features proactively disable buttons when you lack write permissions. However, this isn't yet consistent across all features—the backend always enforces the correct permissions regardless of what the UI shows.
69
60
70
61
## What each role can access
71
62
72
-
The following table summarizes the access level for each role across different areas of the portal.
Replace the role name with `SRE Agent Standard User` or `SRE Agent Reader` as needed.
96
85
97
-
To find your agent's resource ID, run the following command:
98
-
99
-
```azurecli
100
-
az resource show \
101
-
--resource-group <RESOURCE_GROUP> \
102
-
--name <AGENT_NAME> \
103
-
--resource-type Microsoft.SREAgent/agents \
104
-
--query id -o tsv
105
-
```
106
-
107
86
## How roles work together
108
87
109
-
The following example shows how roles interact during an action approval workflow. An engineer requests an action, but only administrators can approve it.
This article covers **user roles** which includes who can do what with the agent. To understand the full access control picture, see:
96
+
## Related content
122
97
123
-
| Article | Page | What you'll learn |
124
-
|-------|------|-------------------|
125
-
|**Run modes**|[Run modes](run-modes.md)| How Review and Autonomous modes control whether the agent asks before acting. Only Administrators can approve in Review mode |
126
-
|**Agent permissions**|[Agent permissions](permissions.md)| How the agent gets access to Azure resources. This includes *Reader* vs *Privileged* permission levels, RBAC roles, and OBO fallback |
127
-
|**Audit**|[Audit agent actions](audit-agent-actions.md)| Review what your agent did, who approved it, and which identity was used |
0 commit comments