How to access SRE agent

Question

An Azure SRE agent was created from our end but while accessing it, it failed to get signed in. And we are not able to fetch subcription details on the SRE agent, even the owner of the account is also unable to fetch the subscription details. Due to that, the agent is not getting configured properly for use.

Answer 1

Hello Manish Surapaneni,

Welcome to Microsoft Q&A and Thanks for sharing the screenshots and details.

From what you’ve described, this doesn’t appear to be a service outage. The behavior is consistent with an authentication/token issue combined with missing RBAC permissions, which is preventing the SRE Agent portal from retrieving your subscription details.

What’s happening

The error “AuthenticationFailedMissingToken” indicates that the portal is not able to pass a valid access token while calling Azure Resource Graph (ARG).

This is also aligned with the “Session expired” prompt you’re seeing, which means your current login session is no longer valid.

In addition, the portal explicitly mentions that access requires the SRE Agent Reader role (or higher). Without this role, the portal will block access to agents and subscriptions—even if you are listed as a subscription Owner.

Because of these two conditions, the portal is unable to:

• Authenticate your requests properly
• Fetch subscription details
• Load or configure the SRE agent

Steps to resolve

Please go through the following steps:

1. Assign the required RBAC role

• Navigate to the Subscription or Resource Group where the SRE Agent was created
• Go to Access Control (IAM) → Role assignments → Add role assignment
• Search for “SRE Agent Reader”

Assign this role to your user account

Owner/Contributor roles do not automatically include this specific permission, so it must be explicitly assigned.

Allow a couple of minutes for the role assignment to propagate.

2. Refresh your authentication session

Sign out of the Azure Portal completely

Close the browser and reopen it (or use an InPrivate/Incognito window)

Sign back in

Also ensure Third-party cookies are allowed for the Azure portal, No browser extensions (privacy/ad blockers) are stripping authentication headers

3. Validate access

• Go back to Azure SRE Agent → Agents
• Click Refresh
• Verify that subscriptions are now loading correctly
• Try opening the agent again

If you continue to see errors after the above steps:

Check whether any Conditional Access policies are blocking token issuance

Try accessing from a different browser or network

Ensure you are logged into the correct tenant/directory

Confirm your session is active (sometimes the session expiry dialog appears in the background)

This issue is occurring because the portal is unable to authenticate your requests (expired/missing token) and your account does not yet have the required SRE Agent RBAC role, which together prevents subscription data from loading. Once the role is assigned and the session is refreshed, access should work as expected.

Please refer this

• Identity Protection of Agents (preview): https://learn.microsoft.com/entra/id-protection/concept-risky-agents
• Microsoft Entra authentication for SQL Server VM: https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/configure-azure-ad-authentication-for-sql-vm?view=azuresql-vm&tabs=azure-portal
• Troubleshoot Microsoft Entra agent collections: https://learn.microsoft.com/entra/identity/hybrid/cloud-sync/how-to-troubleshoot#agent-problems
• What is Microsoft Entra Agent ID?: https://learn.microsoft.com/entra/agent-id/identity-professional/microsoft-entra-agent-identities-for-ai-agents
• Protect agent identities with Microsoft Entra: https://learn.microsoft.com/microsoft-agent-365/admin/capabilities-entra?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider

I Hope this helps. Do let me know if you have any further queries.

---

If this answers your query, please do click Accept Answer and Yes for was this answer helpful.

Thank you!

Answer 2

Hello @Manish Surapaneni,

Here are some troubleshooting steps:

1. Permissions: Ensure that the user account has the necessary permissions. The account should have at least Contributor or Owner access to the resource group that hosts the agent. If the account only has Reader permissions, it won’t be able to interact with the agent properly.
2. Subscription Registration: Verify if your subscription is registered for the SRE Agent. You can check this by running the command az provider show -n Microsoft.App in Azure Cloud Shell. If your subscription is not in the allow list, you will need to register it using az provider register --namespace "Microsoft.App".
3. Firewall Settings: Make sure that your firewall settings allow access to the necessary Azure domains. Specifically, add *.azuresre.ai to your allowlist, as some corporate networks might block access to this domain by default.
4. Check Access: Use the Check Access feature in the Azure portal to confirm that your account has the right permissions to interact with the SRE agent. This can help identify any permission-related issues.

---

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.