Modern cloud applications generate massive amounts of telemetry - metrics, logs, traces, alerts, and platform signals.
Yet whether you're asking questions about your observability data or responding when things go wrong, discovering insights and root causes requires a deep understanding of the application, the observability signals it emits, and the tools, while your business and customers are impacted.
The Observability agent is designed to be your monitoring companion across the full observability lifecycle, enabling you to interact via chat to better understand your observability data. Our aspiration is to support the full range of activities - from onboarding and detection through triage and root cause analysis - to significantly reduce human toil and customer downtime.
Today, the agent already covers key investigation and exploration scenarios, and we’re rapidly expanding its capabilities across more workflows and entry points.
Deep, agentic investigations
Deep investigations are designed for situations where something is already wrong and the goal is to understand what happened and what to do next
The Observability agent is optimized for real‑world, full‑stack investigations in distributed systems - including environments built on Azure Kubernetes Service (AKS) and Virtual Machines (VMs). To discover the root cause, the agent applies deep reasoning, using an innovative array of Machine Learning (ML) and Large Language Models (LLM) to discover and correlate anomalies across huge volume of signals across application, infrastructure, and Azure platform layers to converge on likely root‑cause candidates across scenarios such as:
- Application issues, including deployment and performance regressions, request or dependency failures, resource exhaustion, and identity or configuration errors
- Infrastructure issues, such as compute saturation, disk I/O throttling, misconfigured dependencies, or network connectivity failures in AKS clusters and VMs
- Platform incidents, including Azure maintenance or outages and managed infrastructure issues like SNAT port exhaustion or upgrade blockers
The easiest way to start a deep investigation is directly from an Azure Monitor alert, whether in the Azure portal or from an alert notification. Investigations can also be initiated from other entry points – e.g. the agent chat, Logs, Activity logs with additional entry points being added over time
When a deep investigation runs, the agent produces an investigation report that captures the analysis, root cause, suggested next steps along with the key signals, and supporting data. The agent also surfaces a granular insight into its reasoning / chain-of-thought, including data accessed, queries run and more.
User does not need to stop there – they can continue interacting with the agent, in the context of investigation to explore deeper or guide agent into additional hypothesis:
- What changed shortly before the incident started?
- Are there any issues in VM <vm_id> and are they related? If yes, run a deep investigation including this VM
- Which dependencies are most correlated with this failure spike?
- Are there related alerts or configuration changes that explain this behavior?
Investigation results can be saved as an Azure Monitor Issue, preserving the full investigation context for collaboration and continuity.
Data exploration and analytics
The Observability agent supports data exploration and analytics for ad‑hoc understanding and hypothesis building, without starting from an alert or running a full investigation.
To get started, simply click on the “Observability Agent” button from the Logs blade (or other supported entry points). From there, you can explore observability data such as logs and metrics using natural language prompts like:
- Show the top errors over the last hour
- Is there a correlation between application errors and dependency errors?
- Chart the trend of application errors and storage related errors
- What operations in my app are impacted by the ongoing authentication issue?
- Find latency spikes in my app over the last 3 days and where they are coming from (specific users or regions)
If you already had a query / query results in Logs blade – the agent will pick it up automatically, and you can ask it to explain the results, help you evolve the query or even optimize it.
Moreover, when exploration surfaces a broader or more complex problem, operators can choose to run a deep investigation directly from the exploration context and persist the results as an Issue.
Looking ahead
We’re continuing to expand the Observability agent to cover more of the observability lifecycle, moving from reactive investigation toward more proactive and continuous system understanding:
- Deeper integration across Azure Monitor experiences
Expanding beyond alerts into additional entry points and workflows across the platform - Autonomous observability
When signals indicate emerging or ongoing incidents, the agent can proactively correlate alerts, run investigations, and create Azure Monitor Issues automatically - reducing the need for manual triage - Integration with external systems
Extending investigation context beyond Azure Monitor, so insights and conclusions can flow into existing engineering workflows
Stay connected
- Follow this blog for ongoing deep dives, updates on current capabilities, and a preview of what’s coming next.
- Live webinar
A walkthrough of real Observability agent scenarios, best practices, and what’s available today - along with a look at what’s coming next, and live Q&A with the product team. 👉 Register here
We’d love your feedback
The Observability agent continues to evolve based on real‑world usage and operator feedback. Share your thoughts directly through the Give Feedback option in the experience, or reach us at: azureobsagent@microsoft.com
Microsoft