Deploying the Azure Copilot Observability Agent to Memolog

As Azure Monitor alerts multiply, receiving notifications is no longer enough. You also need to determine whether several alerts point to the same incident and preserve the context gathered during the investigation.

To address this, I deployed the Azure Copilot Observability Agent to Memolog. It correlates Azure Monitor alerts and groups them into Azure Monitor Issues. This article explains what the Observability Agent does, how we deployed it, how it differs from Azure SRE Agent, and the boundaries we set to control costs.

Table of Contents

• Key takeaway
• What is the Azure Copilot Observability Agent?
• How we deployed it to Memolog
• Operational rules we set during deployment
• How it differs from Azure SRE Agent
• Azure Copilot Observability Agent pricing
• What we learned from testing
• Summary

Key takeaway

The Azure Copilot Observability Agent lets you investigate logs, metrics, traces, and alerts in Azure Monitor using natural language. It can also group related alerts into Azure Monitor Issues.

For Memolog, we set Application Insights resource memolog-prod-ai as the monitoring target and deployed the Agent with these boundaries:

• Automatically correlate related alerts and create Issues
• Require a person to decide whether to start a Deep investigation, then run it manually
• Do not automatically remediate incidents by restarting resources, changing settings, or deploying code
• Limit the Managed Identity to reading monitoring data and managing Issues

We chose this approach so we could first assess the quality and volume of the Issues the Agent creates. It also keeps billable Deep investigations under human control instead of enabling fully automated investigation from the outset.

Azure SRE Agent, by contrast, goes beyond monitoring data analysis. It connects to incident management systems, source code, and external monitoring products to automate approved remediation and routine operations. Because our goal was to organize alerts and support investigations within Azure Monitor, we chose the Observability Agent.

What is the Azure Copilot Observability Agent?

Azure Copilot Observability Agent is an AI-powered operations feature built into Azure Monitor. It has three primary uses:

You can use Chat and Deep investigation without creating a dedicated Observability Agent resource. A Microsoft.Monitor/observabilityAgents resource is required when you want a persistent boundary with a Managed Identity, monitoring scope, and Custom instructions, and when you want to enable Autonomous operations.

In addition to correlating multiple alerts into a single incident, Autonomous operations can promote important standalone alerts specified in Custom instructions to Issues.

An Issue serves a different purpose from an Alert, which represents an individual anomalous signal.

The Observability Agent’s autonomous processing is limited to triage and investigation. The official documentation describes this as Controlled autonomy: the Agent does not restart resources, change settings, or resolve Issues on its own.

How we deployed it to Memolog

Memolog consists of an Astro frontend, an Azure Functions-based Hot Topics API, Application Insights, a Log Analytics Workspace, and other components. Azure Monitor Alerts were already monitoring API 5xx responses, latency, collection failures, Table Storage failures, availability, and other signals.

We added these main resources:

The memolog-prod-observability-amw resource that stores Issues is an Azure Monitor Workspace of type Microsoft.Monitor/accounts. It is separate from the memolog-prod-law Log Analytics Workspace that stores Application Insights logs, and it does not replace that workspace.

We kept Application Insights and the runtime resources in East US 2. Only the Observability Agent required for Autonomous operations and the Azure Monitor Workspace that must share its region were placed in East US.

We manage the configuration with Bicep. The essential Operations configuration is:

operations: [
  {
    type: 'IssueCreation'
    mode: 'Auto'
    instructions: issueCreationInstructions
  }
  {
    type: 'Investigation'
    mode: 'Manual'
  }
]

We assigned only these two roles to the Agent’s system-assigned Managed Identity:

During the initial deployment, the service automatically granted Monitoring Contributor at the subscription scope. That permission was broader than necessary for our use case, so we removed it and confirmed after deployment that only the two intended roles remained.

Operational rules we set during deployment

We stored Memolog-specific monitoring rules as natural-language Custom instructions. The main rules are:

• Correlate availability, API latency, HTTP 5xx, prolonged HTTP 499, collection failure, missing collection telemetry, and Table Storage failure alerts that fire within 15 minutes of one another
• Create an Issue for a standalone Sev1 alert related to Hot Topics availability or a collection outage
• Do not group changes in page views or telemetry ingestion volume into an availability incident without evidence of failures or latency
• Do not treat missing telemetry as recovery after the Log Analytics Workspace reaches its daily cap
• Do not include URLs, query strings, tokens, connection strings, personal data, or exception bodies in Issue titles or summaries

Custom instructions are configuration data that can be read as a property of the Azure resource. We therefore include only durable operational rules, never secrets or raw incident-specific data.

We also chose not to enable automatic Deep investigation immediately after deployment. We set IssueCreation=Auto and Investigation=Manual, and will evaluate the following over the first 30 days:

• Number of Issues created by the Agent and number of source Alerts
• Correct correlations, incorrect correlations, and missed correlations
• Number of manually started Deep investigations and AAC usage
• Time from detection to identifying potential causes

How it differs from Azure SRE Agent

Azure Copilot Observability Agent and Azure SRE Agent are easy to confuse because their names and purposes are similar. Based on official information available as of August 16, 2026, the main differences are:

The Observability Agent focuses on understanding Azure Monitor signals and turning them into Issues that are easier to investigate. Azure SRE Agent focuses on connecting monitoring, incident management, source code, and external services to automate SRE work itself.

For this deployment, Memolog’s goal was to reduce noise from existing Azure Monitor Alerts and group signals related to the same incident into an Issue. We did not need integration with an external incident management service or automated remediation, so the Observability Agent let us start with a smaller scope.

Azure Copilot Observability Agent pricing

As of August 16, 2026, the Observability Agent uses usage-based Azure Agent Credit (AAC) billing. Billing began on July 1, 2026.

AAC measures the amount of AI processing performed by the Agent. Rather than tracking a separate price for each model, usage across models is measured in a common AAC unit. See the Azure Monitor pricing page for current AAC pricing.

Deep investigation generally consumes more AAC than Chat because it combines calls to multiple Agents and Tools. The official documentation sets a limit of 500 AAC for each Deep investigation.

For Memolog, we automated only Alert correlation and Issue creation, leaving Deep investigation manual. This lets us evaluate Issue quality with the no-charge Preview feature while requiring a person to confirm the need for each AAC-consuming investigation.

Azure SRE Agent uses a different pricing model. It uses AAU, with charges for both the Always-on flow while the Agent exists and the Active flow for work it performs. The official pricing page lists the Always-on flow at 4 AAU per Agent-hour. That fixed charge continues even when the Agent is stopped, until the Agent is deleted.

Pricing, no-charge features during Preview, models, and limits may change. Before deploying, check Observability Agent billing and Azure SRE Agent billing.

What we learned from testing

After deployment, we ran a Round-trip Test against the Issue API to create, read, and delete a test Issue. This confirmed that Issue storage in the Azure Monitor Workspace and its RBAC configuration worked correctly.

However, a manually created Issue is not the same as an Issue created automatically when the Observability Agent correlates Alerts. Testing Issue storage and testing the Agent’s automatic Issue creation are separate concerns.

We also triggered a temporary Sev1 Alert with no Action Group. We confirmed the Alert itself without reducing application availability or fabricating telemetry, but the Agent did not automatically create an Issue within the short observation window.

One reason was that the first Alert targeted the Log Analytics Workspace behind Application Insights rather than Application Insights itself, which was the Agent’s direct monitoring target. Here is what we have and have not confirmed so far:

In other words, successfully creating the resources and reading their configuration is not the same as confirming that the Agent will create useful Issues during real incidents. We will continue to observe real Alerts and review the titles, Background sections, related Alerts, and correlation rationale in the Issues the Agent creates.

Summary

Azure Copilot Observability Agent lets you investigate observability data in Azure Monitor using natural language, correlate related Alerts, and turn them into Azure Monitor Issues that can be tracked over time.

For Memolog, we made Application Insights the monitoring boundary, automated only Issue creation, and kept Deep investigation manual. We also limited the Managed Identity to the Monitoring Reader and Issue Contributor roles and deployed the Agent within the limits of Controlled autonomy, with no automated remediation.

Azure SRE Agent is an option when you need to connect external monitoring, incident management, and source code systems, then extend automation to approved remediation and routine operations. For a focused start with Alert organization and investigation support inside Azure Monitor, we found that the Observability Agent was a better fit.

The Observability Agent uses usage-based AAC billing for AI processing. During Public Preview, Alert correlation and Issue creation are free, while Chat and Deep investigation are billable. A prudent starting point is to disable automatic Deep investigation, then expand automation gradually while monitoring Issue quality and AAC usage.

References

• Azure Copilot Observability Agent
• Autonomous operations in the Azure Copilot Observability Agent
• Azure Monitor issues
• Billing and cost management for Azure Copilot Observability Agent
• Overview of Azure SRE Agent
• Pricing and billing for Azure SRE Agent