Merge pull request #299393 from craigshoemaker/sre/overview-updates

[SRE Agent] Overview updates

Author: v-shils

articles/app-service/media/sre-agent/sre-agent-knowldege-graph.png

@@ -5,13 +5,13 @@ services: container-apps
 author: craigshoemaker
 ms.service: azure-container-apps
 ms.topic: conceptual
-ms.date: 05/05/2025
+ms.date: 05/06/2025
 ms.author: cshoe
 ---
 
 # SRE Agent overview (preview)
 
-Site Reliability Engineering (SRE) focuses on creating reliable, scalable systems through automation and proactive management. SRE Agent brings these principles to your cloud environment by providing AI-powered monitoring, troubleshooting, and remediation capabilities. An SRE Agent automates routine operational tasks and provides reasoned insights to help you maintain application reliability while reducing manual intervention. Available as a chatbot, you can ask questions and give natural language commands to maintain your applications and services.
+Site Reliability Engineering (SRE) focuses on creating reliable, scalable systems through automation and proactive management. An SRE Agent brings these principles to your cloud environment by providing AI-powered monitoring, troubleshooting, and remediation capabilities. An SRE Agent automates routine operational tasks and provides reasoned insights to help you maintain application reliability while reducing manual intervention. Available as a chatbot, you can ask questions and give natural language commands to maintain your applications and services. To ensure accuracy and control, any agent action taken on your behalf requires your approval.
 
 Agents have access to every resource inside the resource groups associated to the agent. Therefore, agents:
 
@@ -32,9 +32,11 @@ The SRE Agent offers several key features that enhance the reliability and perfo
 
 - **Proactive monitoring**: Continuous resource monitoring with real-time alerts for potential issues and daily resource reports.
 
-- **Automated mitigation:** Automatic detection and mitigation of common issues, reducing downtime and improving resource health.
+- **Automated mitigation:** Automatic detection and mitigation of common issues, reducing downtime and improving resource health. While agents attempt to work on your behalf, all automation requires your approval.
 
-- **Resource visualization**: Comprehensive views of your resource dependencies and health status
+- **Resource visualization**: Comprehensive views of your resource dependencies and health status.
+
+    :::image type="content" source="media/sre-agent/sre-agent-knowldege-graph.png" alt-text="Screenshot of an SRE Agent knowledge graph.":::
 
 An SRE Agent works to proactively monitor and maintain your Azure services. Each day your agent creates daily resource reports which provide insights into the health and status of your applications. Reports include:
 
@@ -50,28 +52,17 @@ An SRE Agent works to proactively monitor and maintain your Azure services. Each
 
 | Scenario | Possible cause | Agent mitigation |
 |---|---|---|
-| Application down | ▪ **Application code issues**: Bugs or errors in the application code can lead to crashes or unresponsiveness.<br><br>▪ **Bad deployment**: Incorrect configurations or failed deployments can cause the application to go down.<br><br>▪ **High CPU/memory/thread issues**: Resource exhaustion due to high CPU, memory, or thread usage can affect application performance. | The SRE Agent can detect these issues and provide actionable insights or automated fixes. For example, it can identify high CPU usage and recommend scaling up the resources or suggest code optimizations. |
-| Virtual machine RDP issues | ▪ **Network configuration problems**: Incorrect network settings can prevent Remote Desktop Protocol (RDP) access to virtual machines.<br><br> ▪ **Firewall rules**: Misconfigured firewall rules can block RDP access.<br><br> ▪ **Resource health**: Virtual machine health issues can affect RDP connectivity. | The SRE Agent can monitor virtual machine health and network configurations, providing alerts and recommendations to resolve RDP issues. Agents can also automate the application of correct firewall rules to restore access. |
+| Application down | ▪ **Application code issues**: Bugs or errors in the application code can lead to crashes or unresponsiveness.<br><br>▪ **Bad deployment**: Incorrect configurations or failed deployments can cause the application to go down.<br><br>▪ **High CPU/memory/thread issues**: Resource exhaustion due to high CPU, memory, or thread usage can affect application performance. | The SRE Agent can detect these issues and provide actionable insights or fixes. For example, it can identify a decrease in web app availability that coincides with a recent slot swap and recommend swapping back slots as first step of mitigation. |
+| Virtual machine RDP issues | ▪ **NSG rules**: Misconfigured NSG rules on the NIC or Subnet can block RDP access. | The SRE Agent can monitor virtual machine health and network configurations, providing alerts and recommendations to resolve RDP issues. Agents can also automate the application of correct firewall rules to restore access. |
 | Container image pull failures | ▪ **Registry authentication issues**: Problems with authentication to the container registry can prevent image pulls.<br><br> ▪ **Network connectivity**: Network issues can disrupt the connection to the container registry.<br><br>▪ **Image availability**: The requested image might not be available or could be missing. | The SRE Agent can detect container image pull failures and provide detailed diagnostics. It can recommend solutions such as verifying registry credentials, checking network connectivity, or ensuring the image is available. |
 
 An agent can provide detailed information about different aspects of your apps and resources. The following examples demonstrate the types of questions you could pose to your agent:
 
-- Which resource group is my app part of?
-- Which regions do I have apps deployed in?
-- Show me all web apps using .NET 6 runtime.
-- Which apps have diagnostic logging turned on?
-- What plan am I running, and who else shares it?
-- Are there any staging slots configured for this app?
-- What services or resources is my web app connected to?
-- Do any apps in my subscription have ARR affinity enabled?
-- Which apps have health checks enabled and what are their probe paths?
-- Are any of my web apps still running on deprecated or unsupported runtime versions?
-
-## Security context
-
-An SRE Agent works on your behalf to evaluate and make changes to your Azure resources. Before you can create an agent, you need to make sure you're using an account that has the appropriate security context.
-
-The user account used to create an agent needs `Microsoft.Authorization/roleAssignments/write` permissions using either [Role Based Access Control Administrator](/azure/role-based-access-control/built-in-roles) or [User Access Administrator](/azure/role-based-access-control/built-in-roles).
+- What can you assist me with?
+- Why isn't my application working?
+- What services is my resource connected to?
+- Can you provide best practices for my resource?
+- What's the CPU and memory utilization of my app?
 
 ## Preview access