Skip to content

Commit cc2b670

Browse files
AnnaMHuffAnnaMHuff
authored
Merge pull request #302835 from craigshoemaker/sre/permissions
[SRE Agent] New: Security context article
2 parents 7c5e551 + 6bbf3fb commit cc2b670

File tree

5 files changed

+128
-51
lines changed

5 files changed

+128
-51
lines changed

‎.openpublishing.redirection.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6879,6 +6879,11 @@
68796879
"redirect_url": "/azure/sre-agent/troubleshoot-azure-container-apps",
68806880
"redirect_document_id": false
68816881
},
6882+
{
6883+
"source_path": "articles/sre-agent/permissions.md",
6884+
"redirect_url": "/azure/sre-agent/security-context",
6885+
"redirect_document_id": false
6886+
},
68826887
{
68836888
"source_path": "articles/reliability/whats-new.md",
68846889
"redirect_url": "/azure/reliability/overview",

‎articles/sre-agent/permissions.md

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎articles/sre-agent/security-context.md

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
title: Security contexts in Azure SRE Agent (preview)
3+
description: Learn how SRE Agent uses different security contexts to handle agent creation and execution.
4+
author: craigshoemaker
5+
ms.author: cshoe
6+
ms.topic: tutorial
7+
ms.date: 07/16/2025
8+
ms.service: azure
9+
---
10+
11+
# Security contexts in Azure SRE Agent (preview)
12+
13+
This article explains the different security contexts involved in Azure SRE Agent operations. The security contexts include the user account that creates the agent, user accounts that interact with the agent, and the agent's own managed identity. Each context has specific permission requirements and serves different purposes in maintaining a secure environment.
14+
15+
Microsoft Entra enforces security policies that govern identity assignments as you associate resource groups with the agent's managed identity.
16+
17+
## Prerequisites
18+
19+
You need to grant your agent the correct permissions and access to the right namespace.
20+
21+
* **Security context**: Before you create a new agent, make sure your user account has the `Microsoft.Authorization/roleAssignments/write` permissions using either [Role Based Access Control Administrator](/azure/role-based-access-control/built-in-roles) or [User Access Administrator](/azure/role-based-access-control/built-in-roles).
22+
23+
* **Sweden Central region access**: During preview, the only allowed region for SRE Agent is Sweden Central. Make sure your user account has *owner* or *admin* permissions and permissions to create resources in the Sweden Central region.
24+
25+
## User security context
26+
27+
The security requirements for users are different depending on if you're creating or using the agent.
28+
29+
| Action | User account requirements |
30+
|---|---|
31+
| Create agent | The user account needs to be in the *Owner* or *User Access Administrator* role with *Owner* or *Admin* permissions in the subscription. |
32+
| Access/run the agent | The user account must have *Contributor* permissions to the resource group the agent is running in, or for the agent instance.<br><br>**Note**: This requirement doesn't mean the user account needs *Contributor* access to the entire subscription or all resource groups.|
33+
34+
## Agent security context
35+
36+
Azure SRE Agent has its own managed identity that gives the agent the required credentials to act on your behalf as it manages assigned resource groups. You have full control over the roles and permissions applied to the managed identity.
37+
38+
When you create the agent from the portal, you can select from different permissions levels best suited for your situation. When you create an agent, you can apply the *Reader* or *Privileged* permission level.
39+
40+
The following table describes the difference between the two levels.
41+
42+
| Permission level | Description |
43+
|---|---|
44+
| Reader | Initially configured with read-only permissions on the resource groups it manages. When an action is required that requires elevated permissions, the agent prompts the user for temporary to complete the action. |
45+
| Privileged | Initially configured to take approved actions on resources and resource types detected in its assigned resource groups. |
46+
47+
At any time, you can change which permissions are available to the agent's managed identity by modifying the access control (IAM) settings of a resource group manged by the agent.
48+
49+
As resource groups are added or removed from the agent's scope, the managed identity's permissions are updated accordingly. Removing a resource group revokes the agent's access to the group entirely.
50+
51+
> [!NOTE]
52+
> You can't directly remove specific permissions from the agent. To restrict the agent's access, you must remove the entire resource group from the agent's scope.
53+
54+
### Roles
55+
56+
The agent's managed identity is often preconfigured with the following role assignments for a managed resource group:
57+
58+
* Log Analytics Reader
59+
* Azure Reader
60+
* Monitoring Reader
61+
62+
Plus any required roles related to specific Azure services in resource groups managed by the agent.
63+
64+
## Agent behavior
65+
66+
The agent behaves differently depending on the permissions assigned, the execution mode, and the type of action it attempts to make. The following tables list how the agent responds in different scenarios.
67+
68+
### Read-only actions
69+
70+
The following table details how the agent behaves when attempting to conduct a read-only operation that requires elevated permissions.
71+
72+
| Agent has permission? | Execution mode | Agent behavior |
73+
|---|---|---|
74+
| Yes | Review | Reads required data and doesn't prompt for approval |
75+
| No | Review | Prompts for approval to take action |
76+
| Yes | Auto | Executes action without requiring approval |
77+
| No | Auto | Prompts for approval, and executes action based on approval status |
78+
79+
### Write actions
80+
81+
The following table details how the agent behaves when attempting to conduct a write operation.
82+
83+
| Agent has permission? | Execution mode | Agent behavior |
84+
|---|---|---|
85+
| Yes | Review | Prompts for approval to take action |
86+
| No | Review | Prompts for approval to take action, if granted the agent temporarily inherits the required permissions from the user |
87+
| Yes | Auto | Executes action without requiring approval |
88+
| No | Auto | Prompts for approval, and executes action based on approval status |
89+
90+
## Related content
91+
92+
* [Troubleshoot common errors](./troubleshoot.md)

‎articles/sre-agent/toc.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,9 @@ items:
1717
- name: Key concepts
1818
expanded: true
1919
items:
20-
- name: Autonomous vs review mode
21-
href: permissions.md
20+
- name: Security context
21+
href: security-context.md
22+
- name: Troubleshooting
23+
href: troubleshoot.md
2224
- name: Billing
2325
href: billing.md

‎articles/sre-agent/troubleshoot.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
title: Troubleshoot common issues in Azure SRE Agent (preview)
3+
description: Learn to troubleshoot common problems in Azure SRE Agent.
4+
author: craigshoemaker
5+
ms.author: cshoe
6+
ms.topic: tutorial
7+
ms.date: 07/16/2025
8+
ms.service: azure
9+
---
10+
11+
# Troubleshoot common issues in Azure SRE Agent (preview)
12+
13+
This guide covers the common problems faced when working with Azure SRE Agent and provides practical solutions to resolve them. The issues are typically related to permissions, regional availability, and administrative access requirements.
14+
15+
## Common troubleshooting scenarios
16+
17+
The following table outlines frequent issues you might encounter and their solutions. For more information about how roles and permissions are applied to an agent, see [Security contexts in Azure SRE Agent](./security-context.md).
18+
19+
| Scenario | Reason | Remarks |
20+
|---|---|---|
21+
| The agent shows a permissions error in the chat and knowledge graph. | The agent is created with *Contributor* access and an account with only *Reader* permissions attempts to interact with the agent. | Deny assignments or Azure Policy blocks identity assignment to the agent resource group. |
22+
| The location dropdown is blank. | A non-US region policy blocks access to Sweden Central. | If your subscription or management group limits to US-only deployments, then the creation step fails. |
23+
| The *Create* button is disabled. | Lack of administrative permissions. | Agent identity assignments fail if the user account lacks *Owner* or *User Access Administrator* permissions. |
24+
25+
## Related content
26+
27+
- [Security contexts](./security-context.md)

0 commit comments

Comments
 (0)