You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: 'Connect Azure Monitor to your agent with zero credentials so alerts are detected, acknowledged, and investigated automatically.'
4
+
author: dchelupati
5
+
ms.author: dchelupati
6
+
ms.date: 04/01/2026
7
+
ms.topic: how-to
8
+
ms.service: azure-sre-agent
9
+
ai-usage: ai-assisted
10
+
---
11
+
12
+
# Azure Monitor alerts
13
+
14
+
Connect Azure Monitor through the agent's managed identity—no API keys or credentials needed. The scanner detects new alerts every minute, acknowledges them, and creates investigation threads automatically.
15
+
16
+
> [!TIP]
17
+
> - Zero-credential setup—uses the agent's managed identity
18
+
> - Detects new alerts every minute and creates investigation threads
19
+
> - Recurring alerts from the same rule merge into one thread
20
+
21
+
## How it works
22
+
23
+
Azure Monitor is the default incident platform for Azure SRE Agent. When your agent has Reader access to Azure subscriptions, it automatically detects Azure Monitor alerts and creates investigation threads.
24
+
25
+
The alert scanner runs every minute and performs these actions:
26
+
27
+
1.**Detects** new fired alerts across your monitored subscriptions
28
+
2.**Acknowledges** each alert to prevent duplicate investigations
29
+
3.**Creates** an investigation thread with the alert context
30
+
4.**Merges** recurring alerts from the same alert rule into a single thread
31
+
32
+
## Alert merging
33
+
34
+
When the same alert rule fires multiple times, the agent merges these alerts into a single investigation thread instead of creating separate threads for each firing. This consolidates related signals and prevents alert fatigue.
35
+
36
+
## Prerequisites
37
+
38
+
- An Azure SRE Agent in **Running** state
39
+
- Azure subscriptions added to the agent's monitored scope
40
+
- The agent's managed identity needs **Reader** role on the monitored subscriptions
41
+
- The agent's managed identity needs **Monitoring Contributor** role at subscription scope for alert management (assigned automatically during agent creation through the portal)
Copy file name to clipboardExpand all lines: articles/sre-agent/diagnose-azure-observability.md
+4-1Lines changed: 4 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Diagnose with Azure Observability in Azure SRE Agent
3
3
description: Learn how your agent queries Application Insights, Log Analytics, Azure Monitor metrics, Activity Logs, Resource Graph, and resource-specific diagnostics automatically without connectors.
4
4
ms.topic: concept-article
5
5
ms.service: azure-sre-agent
6
-
ms.date: 03/18/2026
6
+
ms.date: 04/01/2026
7
7
author: craigshoemaker
8
8
ms.author: cshoe
9
9
ms.ai-usage: ai-assisted
@@ -90,6 +90,9 @@ Your agent discovers available metrics for any resource type, queries time-serie
90
90
91
91
When your agent uses Azure Monitor as its incident platform, it also manages alerts directly by acknowledging and closing them during investigation.
92
92
93
+
> [!NOTE]
94
+
> Alert management requires the **Monitoring Contributor** role at subscription scope. Your agent receives this role automatically when created through the portal. If the role is missing, a banner appears with an **Assign Monitoring Contributor role** button that assigns the role directly.
95
+
93
96
### Resource graph and activity logs
94
97
95
98
Your agent uses Resource Graph and Activity Logs to discover resources and correlate changes with incidents.
title: Azure Data Explorer connector in Azure SRE Agent
3
+
description: Connect your agent to Azure Data Explorer (Kusto) clusters to query logs and telemetry, with support for multiple clusters, per-cluster health checks, and identity-based grouping.
#customer intent: As an SRE, I want to connect my agent to Azure Data Explorer clusters so that it can query logs and telemetry for incident diagnosis and health checks.
12
+
---
13
+
14
+
# Azure Data Explorer connector in Azure SRE Agent
15
+
16
+
> [!TIP]
17
+
> -**Connect to ADX clusters** - Give your agent access to logs and telemetry stored in Azure Data Explorer.
18
+
> -**Multiple clusters in one connector** - Group cluster URIs by managed identity instead of creating separate connectors.
19
+
> -**Per-cluster health checks** - See which clusters are healthy and which need attention, individually.
20
+
> -**Test before you save** - The wizard tests connectivity to each cluster before creating the connector.
21
+
22
+
## Why connect to Azure Data Explorer?
23
+
24
+
Azure Data Explorer (Kusto) is where teams store operational telemetry—application logs, infrastructure metrics, deployment traces, and service health signals. Connecting your agent to ADX lets it query this data directly when diagnosing incidents, running health checks, or generating reports.
25
+
26
+
With the ADX connector, your agent can:
27
+
28
+
- Query logs across multiple clusters and databases.
29
+
- Correlate telemetry from different regions or services during an incident.
30
+
- Run scheduled health checks against your telemetry data.
31
+
- Power [Kusto tools](kusto-tools.md) with deterministic, parameterized queries.
32
+
33
+
## What the connector enables
34
+
35
+
Once you create an ADX connector, your agent automatically gains access to Kusto query tools—no additional setup required. These tools let the agent:
36
+
37
+
| Tool | What it does |
38
+
|------|--------------|
39
+
|**Query**| Run KQL queries against any connected cluster and database |
40
+
|**List databases**| Discover available databases on a cluster |
41
+
|**List tables**| Show tables within a database |
42
+
|**Table schema**| Inspect column names and types for a table |
43
+
|**Sample data**| Preview rows from a table |
44
+
45
+
This means the moment your connector tests successfully, you can ask your agent questions like:
46
+
47
+
```text
48
+
Show me error rates from the servicetelemetry database in the last 24 hours
49
+
```
50
+
51
+
The agent writes and executes KQL on your behalf, using the connector's managed identity for authentication.
52
+
53
+
### Two ways to query
54
+
55
+
| Approach | How it works | Best for |
56
+
|----------|-------------|----------|
57
+
|**Ad-hoc queries**| Agent generates KQL during chat based on your question | Investigations, exploration, one-off analysis |
58
+
|**Kusto tools**| Pre-built, parameterized KQL templates you define once | Repeatable health checks, standardized reports |
59
+
60
+
Ad-hoc queries work immediately with the connector. For Kusto tools, see [Kusto tools](kusto-tools.md) to create reusable query templates.
61
+
62
+
## How the ADX connector works
63
+
64
+
The ADX connector supports **multiple clusters in a single connector** through cluster groups. Each group shares a managed identity, so you don't need to create separate connectors for every cluster.
65
+
66
+
### Cluster groups
67
+
68
+
A cluster group is a collection of ADX cluster URIs that share the same managed identity. You can have multiple groups within one connector—each with its own identity—to handle clusters across different tenants or permission boundaries.
69
+
70
+
For example, if your production clusters use one managed identity and your staging clusters use another, you create two groups within the same connector. The "(inherit)" option on each group uses the connector-level identity by default; override it per group when needed.
71
+
72
+
### Per-cluster health checks
73
+
74
+
The connector tests each cluster individually—both during setup and on an ongoing basis. If some clusters become unreachable after saving, the connector status calls out the failing clusters by name (for example, *"2 cluster(s) failed: cluster1, cluster2"*) so you know exactly which cluster needs attention.
75
+
76
+
### Edit connectors
77
+
78
+
You can add or remove cluster URIs from an existing connector without recreating it. The edit dialog opens directly to the cluster configuration—update URIs, adjust group identities, and re-test.
Your team runs services across three Azure regions, each with its own ADX cluster:
83
+
84
+
| Cluster | Database | Region |
85
+
|---------|----------|--------|
86
+
|`https://prod-westus.westus.kusto.windows.net/servicetelemetry`| servicetelemetry | West US |
87
+
|`https://prod-eastus.eastus.kusto.windows.net/servicetelemetry`| servicetelemetry | East US |
88
+
|`https://prod-westeu.westeurope.kusto.windows.net/servicetelemetry`| servicetelemetry | West Europe |
89
+
90
+
With cluster grouping, you create one connector named `prod-telemetry`, select your managed identity, and add all three cluster URIs in a single group. After testing confirms all three clusters connect, your agent can query telemetry from any region through one connector.
91
+
92
+
## Related content
93
+
94
+
-[Kusto tools](kusto-tools.md)
95
+
-[Connectors overview](connectors.md)
96
+
-[Set up an Azure Data Explorer connector](kusto-connector.md)
Copy file name to clipboardExpand all lines: articles/sre-agent/kusto-connector.md
+51-19Lines changed: 51 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,17 +1,17 @@
1
1
---
2
2
title: "Tutorial: Connect to Azure Data Explorer (ADX) in Azure SRE Agent"
3
-
description: Connect your SRE agent to Azure Data Explorer (Kusto) clusters so it can run KQL queries against your logs and telemetry data.
3
+
description: Connect your SRE agent to Azure Data Explorer (Kusto) clusters with per-cluster connectivity testing before saving.
4
4
ms.topic: tutorial
5
5
ms.service: azure-sre-agent
6
-
ms.date: 03/18/2026
6
+
ms.date: 04/01/2026
7
7
author: craigshoemaker
8
8
ms.author: cshoe
9
9
ms.ai-usage: ai-assisted
10
10
#customer intent: As an SRE, I want to connect my agent to Azure Data Explorer so that it can query logs and telemetry during incident investigations.
11
11
---
12
12
13
13
# Tutorial: Connect to Azure Data Explorer (ADX) in Azure SRE Agent
14
-
In this tutorial, you connect your SRE agent to an Azure Data Explorer (Kusto) cluster. After you complete the setup, the agent can run KQL queries against your logs and telemetry data to support incident investigations and diagnostics.
14
+
In this tutorial, you connect your SRE agent to an Azure Data Explorer (Kusto) cluster. The connector wizard tests connectivity per-cluster before saving, so you can verify access before committing the configuration.
15
15
16
16
**Estimated time**: 15 minutes
17
17
@@ -20,13 +20,14 @@ In this tutorial, you learn how to:
20
20
> [!div class="checklist"]
21
21
> - Locate your Azure Data Explorer cluster URL and database name
22
22
> - Grant the agent's managed identity access to the database
23
-
> - Add and test the Kusto connector in the SRE Agent portal
23
+
> - Add an Azure Data Explorer connector with cluster groups
24
+
> - Test per-cluster connectivity and save the connector
24
25
25
26
## Prerequisites
26
27
27
28
- An existing Azure Data Explorer cluster
28
29
- Admin access to grant database permissions on the target cluster
29
-
- An agent created in the SRE Agent portal
30
+
- An agent created in the SRE Agent portal with a managed identity (system-assigned or user-assigned)
30
31
31
32
## Get your cluster details
32
33
@@ -38,7 +39,7 @@ To configure the connector, you need the cluster URL and at least one database n
38
39
https://<CLUSTER_NAME>.<REGION>.kusto.windows.net
39
40
```
40
41
41
-
1. Note the name of the database you want the agent to query.
42
+
1. Note the name of the database you want the agent to query. You'll need the full URL in the format `https://<CLUSTER_NAME>.<REGION>.kusto.windows.net/<DATABASE_NAME>`.
42
43
43
44
## Grant the agent database permissions
44
45
@@ -54,22 +55,45 @@ Replace `<DATABASE_NAME>` with your database name and `<AGENT_MANAGED_IDENTITY_I
54
55
55
56
## Add the connector in the portal
56
57
57
-
Configure the Kusto connector in the SRE Agent portal.
58
+
Configure the Azure Data Explorer connector in the SRE Agent portal.
58
59
59
60
1. Go to **Builder** > **Connectors**.
60
61
1. Select **Add connector**.
61
-
1. Select **Kusto**.
62
-
1. Enter the following values:
63
-
-**Name**: A descriptive name for the connector, such as "production-logs".
64
-
-**Cluster URL**: The cluster URL from the previous step.
65
-
-**Database**: The default database name.
66
-
1. Select **Test connection** to verify the configuration.
62
+
1. Select the **Azure Data Explorer** card.
63
+
1. Select **Next**.
67
64
68
-
You see a **Connection successful** confirmation. If the test fails, check the [Troubleshooting](#troubleshoot-common-issues) section.
65
+
### Set up the connector
69
66
70
-
**Checkpoint:** The connector appears in your **Connectors** list with a **Connected** status badge.
67
+
1. Enter a **Name** for the connector, such as "production-logs".
68
+
1. Select a **Managed identity** from the dropdown.
69
+
1. Select **Next**.
71
70
72
-
1. Select **Save**.
71
+
### Add clusters
72
+
73
+
1. Enter a **Group name** for the cluster group (such as "production").
74
+
1. Select a **Managed identity** for this cluster group, or leave as **(inherit)** to use the connector-level identity.
75
+
1. Under **Clusters**, enter your cluster URL in the format `https://<CLUSTER_NAME>.<REGION>.kusto.windows.net/<DATABASE_NAME>`.
76
+
1. To add more clusters to the same group, type each URL in the next row — a new row appears automatically when you fill the current one.
77
+
1. To add a second group with different clusters or a different identity, select **+ Create new group**.
78
+
1. Select **Next**.
79
+
80
+
### Test connection and save
81
+
82
+
1. Review your connector details—connector type, name, managed identity, and cluster groups.
83
+
1. Each cluster group shows a **Not tested** label.
84
+
1. Select **Test connection**. The button changes to **Testing connection...** while connectivity is verified.
85
+
1. After testing completes, each cluster shows a result:
86
+
- A green checkmark icon means the cluster is reachable.
87
+
- A red X icon means the cluster is unreachable, with an error message displayed inline.
88
+
1. Once testing completes, the button changes to **Add connector**.
89
+
1. Select **Add connector** to save.
90
+
91
+
> [!TIP]
92
+
> If a cluster fails the test, go back to verify the cluster URL format and that the managed identity has the correct permissions on that cluster.
93
+
94
+
## Edit an existing connector
95
+
96
+
To modify an existing Azure Data Explorer connector, select the connector name or the edit icon in the Connectors list. The wizard opens directly at the **Add clusters** step, skipping the connector picker.
73
97
74
98
## Verify the connection
75
99
@@ -87,12 +111,20 @@ The agent returns a list of tables from the connected database.
87
111
88
112
If you encounter problems during setup, review the following common causes.
89
113
90
-
### Connection test fails
114
+
### Connection test fails with a permission error
115
+
116
+
- Verify the managed identity has the viewer role on the target database by running `.show database <DATABASE_NAME> principals`.
117
+
- Ensure you used the correct managed identity client ID when granting permissions.
118
+
119
+
### Connection test fails with an unreachable error
91
120
92
-
- Verify the cluster URL is correct and includes the region.
93
-
- Ensure the managed identity has the viewer role on the target database.
121
+
- Verify the cluster URL is correct and includes the region and database name.
94
122
- Check that your firewall rules allow connections from SRE Agent IP addresses. For the list of required IP addresses, see [Network requirements](network-requirements.md).
95
123
124
+
### Not tested badge remains after clicking Test connection
125
+
126
+
- Wait for the test to complete. Large clusters may take a few seconds to respond.
0 commit comments