AzureFeeds

Picture a busy afternoon: an app starts throwing 5xx, and you go looking for why. The good news is that Azure almost certainly already holds the answer. The Portal has the resource. Azure Resource Graph knows what’s actually deployed. Monitor has the metrics, Log Analytics has the logs, Advisor has the recommendations, and the CLI reaches the rest. Azure is remarkably data-rich — very little about your estate is truly hidden. The real challenge at scale is human bandwidth: stitching a dozen surfaces into a single answer while the clock is running.

There’s a second, quieter category of work, too — the things that never prompt you to open a tab in the first place. A database whose backups quietly stopped succeeding. A workload that grew business-critical before anyone gave it a DR pair. A Key Vault secret ticking toward expiry. The signals to catch every one of these already exist in Azure; what’s missing is simply someone (or something) with the time to watch all of them, continuously, across the whole estate.

Now multiply that across a real environment — hundreds of resources, dozens of teams, and a platform that keeps evolving as Azure ships new capabilities and retires older ones. Nobody here is short on skill or data; there’s just far more signal than any human can watch at once. And that — always-on, correlate-everything, catch-it-early work — is exactly what AI is good at. It’s the gap this workbench is built to fill.

What if your subscription had a copilot that already knew the answer — and had been watching for the problem before you asked?

Meet the Azure Support Agent

The Azure Support Agent is an open-source, AI-driven operations workbench that you deploy into your own tenant. Point it at a subscription and it discovers your workloads (e.g. find related resources using AI inferencing), reverse-engineers live architecture diagrams (how difficult has it been for you to catch-up with diagrams? how about live+living documentation?), runs Well-Architected-style assessments, and puts a team of specialist AI agents at your disposal to investigate, monitor, and remediate.

It talks to Azure through the official Azure MCP server and a Microsoft Graph (Entra ID) MCP server — the same Model Context Protocol that’s quickly becoming the standard way for AI to use real tools. Between them that’s over a hundred read-classified tools, so the agent reasons over live evidence from your estate, not a training-data guess about how Azure works. In other words, it doesn’t replace any of Azure’s tooling — it orchestrates it on your behalf, on top of the platform APIs you already trust.

And it runs where your data already lives. One click deploys it to Azure Container Apps in your subscription; nothing about your estate leaves your tenant.

the Architecture Designer showing reverse-engineered architecture diagram of your workload with the help of AI, overlay with assessments, launch tools direclty

Converse — a chat that reads your tenant, and a war room for the hard ones (Part 2)

Back to that bad afternoon — except this time you don’t open eight tabs. You ask, in plain English: “Why is the checkout API throwing 5xx?” — and the agent answers by doing the work, not by guessing from training data. It queries your live estate through the MCP tools and streams its reasoning and every tool call back to you as it goes, so you can see exactly which resources it looked at. Those turns are durable: reload the page and the timeline is still there, and if you cancel a long answer the work keeps running server-side instead of evaporating. You can keep several investigations going at once, paste in a screenshot of a failing blade, and lean on a starter suggestion when you’re not sure what to ask.

When a question is genuinely hard, you switch on Deep mode and a War Room convenes. Instead of one model guessing, a team of specialists goes to work in parallel — a Networking specialist checks NSGs, private endpoints and DNS; an Identity specialist looks at managed identities and expiring secrets; Compute, Storage, Security and Reliability specialists each take their own angle — every one of them pulling live evidence from your estate at the same time. They form hypotheses, throw out the ones the evidence contradicts, and converge. Ninety seconds later you have a conclusion rather than a hunch: the app’s Key Vault secret expired overnight; here’s the dependency chain that proves it, and here’s the exact command to rotate it. The whole investigation is saved as a navigable hypothesis tree attached to the chat, so the next person doesn’t start from zero.

send a message to War Room and let it assemble independent Azure Support Agents, then launch those agents independently to investigate

 

each agent goes and ‘forms hypothesis’, then ‘validates the hypothesis’, and the agents have a meeting and form a conclusion

 

all the agents meet at the end an present you with conclusion — RCA on what it found

Map — turn sprawl into a picture you can actually use (Part 3)

You can’t reason about resources you can’t see, and almost nobody has a current map of their own estate — so the agent builds one for you. It groups raw resources into Workloads (the resources that actually make up one application) and gives each a composite, explainable health score; if you’d rather not draw those boundaries by hand, Autopilot studies the estate and proposes the groupings for you to approve.

Then it gets visual. Point it at a workload and it reverse-engineers an interactive architecture diagram from what’s genuinely deployed, inferring the real relationships — NIC to subnet to VNet, app to plan, private endpoint to target — instead of trusting a stale Visio. It keeps a persistent Architecture Memory for each design (intended topology, security model, resiliency targets, known gaps) that later feeds those War Room investigations as expert context, and it flags drift when the live estate wanders from the design. It will even draft the on-call “know-me” doc for a workload, auto-filling what Azure knows and marking human-only facts — SLAs, escalation paths, RTO/RPO — as explicit TODOs rather than inventing them. Zoom all the way out and the Estate Graph renders your whole tenant as one searchable, workload-aware map, with cost, retirement and RBAC overlays and deep links straight to the underlying resource.

Use AI to discover your Azure workloads from a management group/subscription/rg scopes, then group their resources to perform proactive operations

 

A reverse-engineered estate graph of your Azure Workload

Assess — go looking for trouble before it finds you (Part 4)

This is where “proactive” stops being a slogan. Most tooling waits to be asked; the Azure Support Agent runs a battery of assessments that hunt for risk before the ticket exists, each judging your estate against a reviewed, versioned baseline rather than a vibe.

It starts with coverage: which resources are missing the Azure Monitor baseline alerts they ought to have, and which are shipping no diagnostic logs at all — then it hands you ready-to-apply Bicep or Terraform to close the gaps. It audits backup and DR the same way: is each resource actually backed up, with adequate retention, an offsite copy and a DR pair that’s been drilled — or will you find out during the outage? A Performance Profiler reads live metrics and ranks every resource by saturation on a heatmap, naming the workload’s binding bottleneck before your users feel it. And for the big picture it scores a workload against the five Well-Architected pillars with reproducible, deterministic math (never a random number a model made up), turns the architecture into a quantified FMEA risk register, and gives you a read-only identity and RBAC posture — expiring credentials, ownerless apps, MFA gaps, and who can really do what. The payoff is a change of timing: you stop discovering that a database was never backed up at the worst possible moment, and start seeing it on a dashboard on a quiet Tuesday.

Azure Monitor Baseline Alerts (AMBA) assessment against your Azure Workload – showing where you have/have not configured alerting

 

Performance Profiler – unified matrix view of all your resources in an Azure Workload and their performance metrics at a point in time

 

AI driven change explorer on what changed in your Azure Workload during a time window

 

Conduct AI assisted Failure Mode and Effects Analysis (FMEA) against your Azure Workload

Act — don’t just find it, fix it (safely) (Part 5)

Findings that die in a dashboard help no one, so the last pillar is about closing the loop — carefully. You can dry-run an Azure Policy deny and measure its real blast radius — exactly which resources it would hit — before you enforce a thing. You can straighten out ownership and tagging from a single owner directory and tag census, applying corrections as real tags with snapshots and a one-click revert if anything looks off. And Change Explorer tells you, in plain English, what changed across your estate, who changed it, and whether it was risky — the forensics you always wish you had mid-incident.

From there it helps you get ahead of the calendar and, eventually, take yourself out of the loop. Retirement Radar maps Azure service retirements and breaking changes to the specific workloads they’ll hit, with real deadlines; the Reservations view tells you whether your commitments are actually paying off or quietly leaking money. Mission Control runs every analysis on a workload at once for a single go/no-go verdict — which you can then put on a schedule with Automations, routing results to Teams, Jira or ServiceNow so the whole loop runs without you babysitting it. Everything that writes stays proposal-first: the AI suggests, you approve.

Mission Control’s per-workload go/no-go verdict, pick a workload, launch and let it warm up

Unified view of Azure retirements and breaking changes against your Azure Workload

 

Built to be trusted

None of this is worth much if you can’t hand it the keys with a clear conscience, so the trust model is deliberately conservative. The agent is read-only by default — every write is approval-gated and recorded in a full audit log, that can be sent to Splunk, CrowdStrike NG SIEM, or others. Full EntraID based authentication, It runs in your Azure Container App with private endpoints intra-service, so nothing about your estate ever leaves your tenant. And the AI is off until you switch it on: bring your own provider — OpenAI, Azure OpenAI, Anthropic Claude, Google Gemini, GitHub Copilot, Mistral, or a local model via Ollama or LM Studio — and there is zero LLM traffic until you explicitly configure one. This is the difference between a chatbot that answers from memory and a workbench that uses tools against live evidence, shows its working, and leaves you with artifacts you keep. It matters enough that a whole later post is devoted to it — Part 6 — covering the full access model and how the answers stay grounded, reproducible and free of fabrication.

Where this series goes

This is Part 1 of a seven-part tour. Each post ahead goes deep on one pillar of the workbench, leads with a real screenshot, and stands on its own — so skip to whichever one solves your problem this week:

• Part 2 — The War Room: watch a team of AI specialists root-cause a 5xx in ninety seconds.


• Part 3 — Map your estate: live architecture diagrams, Workloads, know-me docs, the Estate Graph.


• Part 4 — Assess before it pages you: alert/telemetry and backup/DR coverage, Well-Architected scores, FMEA risk registers and identity & RBAC — with the IaC to fix the gaps.


• Part 5 — Act: govern, fix, and stay ahead: Policy dry-runs and blast radius, ownership & tags, change forensics, retirement radar, reservations and Mission Control.


• Part 6 — Letting AI into your Azure: the read-only-by-default access model, grounded and deterministic answers, and bring-your-own-model.


• Part 7 — How it’s wired: the agents, the MCP layer, and one-click deploy — for the builders.

Whether you’re on-call chasing a root cause, an architect who needs a current diagram, on the security team watching RBAC and secrets, or a FinOps owner hunting waste, there’s a part above with your name on it.

The bottom line

The promise of this project is a shift in posture. Your estate stops being a mystery you interrogate after something breaks, and becomes a system that tells you what’s wrong — often before anyone gets paged.

Picture next Monday. The expiring Key Vault secret shows up on a dashboard the Thursday before, and gets rotated in the quiet — so the 5xx afternoon simply never happens. The database with the failing backups is flagged, with generated Bicep to fix it, a week ahead of the quarterly DR drill instead of during the post-mortem. Nothing about your Azure changed except when you found out.

Try it yourself

It’s open source and free to run. Three ways to start, in rising order of commitment:

1. Explore demo mode — synthetic data, no connection required, nothing to risk.


2. Deploy to your tenant — one click to Azure Container Apps; private networking; your data never leaves.

Or main repository https://github.com/zmustafa/AzureSupportAgent

Part 1 Original

Next time — Part 2: The War Room — watch AI root-cause a 5xx in ninety seconds. We’ll go inside a live Deep-mode investigation: how a team of specialist agents fans out across your estate in parallel, forms and discards hypotheses against real evidence, and converges on a root cause you can navigate — and trust. It’s the single best demonstration of what an AI ops workbench actually feels like.