Edit

Set up the SRE Agent MCP server

You set up a working connection between your MCP client (VS Code, Copilot CLI, Cursor, or Claude) and your SRE Agent. After setup, you can list agents, run investigations, manage connectors, and search knowledge in natural language. For more information, see SRE Agent MCP server.

Prerequisites

  • An SRE Agent resource in Azure (provisioning state: Succeeded)
  • Node.js LTS installed
  • Azure CLI installed
  • An MCP-compatible client: VS Code with GitHub Copilot, Copilot CLI, Cursor, Claude Code, or Claude Desktop

Sign in to Azure

az login

If you have multiple subscriptions, set a default:

az account set --subscription <subscription-id>

Note

If your SRE Agent is in a different tenant from your workstation, specify the tenant:

az login --tenant <agent-tenant-id>

This command changes credential context for all subsequent CLI operations in the session. After finishing MCP work, run az login without --tenant to return to your default tenant.

Assign permissions for SRE Agent

You need the Reader role (control-plane) and the SRE Agent Administrator role (data-plane) on the SRE Agent resource. For details on what each role enables, see SRE Agent MCP server.

Note

Assign roles at the narrowest scope possible, preferably the individual agent resource. Subscription-scope Reader grants read access to all resources in the subscription, not just your agent.

# Find your object ID
az ad signed-in-user show --query id -o tsv

# Control-plane access (list and get agents, connectors)
az role assignment create \
  --assignee <your-upn-or-object-id> \
  --role "Reader" \
  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.App/agents/<agentName>

# Data-plane access (threads, memories, tasks, prompts, workflows)
az role assignment create \
  --assignee <your-upn-or-object-id> \
  --role "SRE Agent Administrator" \
  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.App/agents/<agentName>

Register the Azure MCP server with your client

Install the Azure MCP Server extension from the VS Code marketplace. Sign in to your Azure account when prompted.

The extension registers the MCP server automatically. After installation, SRE Agent tools are available in the Copilot Chat sidebar.

Verify the MCP server connection

Ask your client:

"List my SRE agents in subscription <subscription-id>"

You should see your agents listed with their names, resource groups, locations, and status.

If sreagent_* tools appear and return results, the connection is working.

Start an SRE Agent investigation

"Create a thread on agent <agent-name> and investigate why the production API has elevated latency"

Your agent creates a thread, investigates the issue, and returns findings inline.

Explore SRE Agent operations

Try these prompts:

"Search memories on agent <agent-name> for 'deployment failures'"
"List scheduled tasks on agent <agent-name>"
"Create a Kusto connector named prod-logs pointing at cluster https://help.kusto.windows.net, database Samples"
"List active incidents on agent <agent-name>"
"Pause the nightly health check on agent <agent-name>"

Keep the Azure MCP server up to date

The @latest tag pulls the newest version on each launch, but npx caches aggressively. To force an update, run:

rm -rf ~/.npm/_npx

For version stability, pin an exact version:

"args": ["-y", "@azure/mcp@1.2.3", "server", "start"]

Troubleshooting

Symptom Cause Fix
sreagent_* tools don't show up Stale npx cache Run rm -rf ~/.npm/_npx, restart client
"SRE Agent resource not found" Wrong tenant or subscription Run az login --tenant <id>, set correct subscription.
401/403 on data-plane calls Missing SRE Agent Administrator role Assign the role at the agent scope.
403 on ARM calls Missing Reader role Assign Reader at subscription, RG, or agent scope.
"No agent endpoint" Agent not fully provisioned Check provisioningState in the Azure portal.
Wrong tenant errors Credentials from a different tenant Run az login --tenant <id>, restart client.

Related content

  • Last updated on