Tutorial: Troubleshoot an app using an Azure SRE Agent (preview) in Azure Container Apps

2025-06-24

The Azure SRE Agent helps you manage and monitor Azure resources by using AI-enabled capabilities. Agents guide you in solving problems and aids in build resilient, self-healing systems on your behalf.

In this tutorial, you:

Deploy a sample container app using the Azure portal
Create an Azure SRE Agent to monitor the app
Intentionally misconfigure the container app
Use AI-driven prompts to troubleshoot and fix errors

Important

The following tutorial features an AI-enabled service powered by a language model. The steps represented in this article reflect how the model is expected to respond. However, the responses you encounter from your agent differs from what you see listed here. Use the sample prompts as examples to help you achieve your goals.

Prerequisites

Azure account: An Azure account with an active subscription is required. If you don't already have one, you can create an account for free.
Security context: Ensure your user account has the Microsoft.Authorization/roleAssignments/write permissions using either Role Based Access Control Administrator or User Access Administrator.
Namespace: Using the cloud shell in the Azure portal, run the following command:
```
az provider register --namespace "Microsoft.App"
```

1. Create a container app

Begin by creating an app for your agent to monitor.

Go to the Azure portal and search for Container Apps in the top search bar.
Select Container Apps in the search results.
Select the Create button.

Basics tab

In the Basics tab, take the following actions.

Enter the following values in the Project details section.

Setting	Action
Subscription	Select your Azure subscription.
Resource group	Select Create new and enter my-aca-app-group.
Container app name	Enter my-container-app.
Deployment source	Select Container image.

Enter the following values in the Container Apps Environment section.

Setting Action

Region Select a region near you.

Container Apps Environment Use the default value.
Select the Container tab.
Select the checkbox next to Use quickstart image.

Setting	Action
Region	Select a region near you.
Container Apps Environment	Use the default value.

Deploy the container app

Select Review and create at the bottom of the page.

If no errors are found, the Create button is enabled.

If there are errors, any tab containing errors is marked with a red dot. Navigate to the appropriate tab. Fields containing an error are highlighted in red. Once all errors are fixed, select Review and create again.
Select Create.

A page with the message Deployment is in progress is displayed.

Once the deployment is complete, you see the message: Your deployment is complete.

Verify deployment

To view your new container app, select Go to resource.
To your application in a browser, select the link next to Application URL.
The following message appears in your browser.

2. Create an agent

Next, create an agent to monitor the my-aca-app-group resource group.

Go to the Azure portal and search for and select SRE Agent.
Select Create.

Enter the following values in the Create agent window.

During this step, you create a new resource group specifically for your agent which is independent of the resource group used for your application.

In the Project details section, enter the following values:

Property	Value
Subscription	Select your Azure subscription.
Resource group	Enter my-sre-agent-group.

In the Agent details section, enter the following values:

Property	Value
Agent name	Enter my-aca-sre-agent.
Region	Select Sweden Central. During preview, the SRE Agent is only available in the Sweden Central region, but an agent can monitor resources in any Azure region.
Run mode	Select *Review. When in review mode, the agent works on your behalf only with your approval.

In the Managed resource groups section, select the Select resource groups button.
In the Select resource groups to monitor window, search for the resource group you want to monitor.

Avoid selecting the resource group name link.

To select a resource group, select the checkbox next to the my-aca-app-group resource group.
Scroll to the bottom of the dialog window and select Save.
Select Create.

A page with the message Deployment is in progress is displayed.

Once the deployment is complete, select Chat with agent.

3. Chat with your agent

Your agent has access to any resource inside the resource groups associated with the agent. Use the chat feature to help you inquire about and resolve issues related to your resources.

In the chat box, give your agent the following command.
```
List my container apps
```
The agent responds with details about the container app deployed in the my-aca-app-group resource group.

Now that you have an agent that sees your container app, you can create an opportunity for the agent to make a repair on your behalf.

4. Break the app

By introducing a typo into the container image tag, you bring the app down so the agent can bring it back up.

Go to your container app in the Azure portal.
From the side menu, under Application, select Revisions and replicas.
Select Create new revision.
Select the container name beginning with simple-hello-world which opens the Edit container window.
Append a 1 the value in the Image and tag box.

The value should now read k8se/quickstart:latest1.
Select Save to exit the Edit container window.
Select Create to create the new revision.

Once you create the new revision, you return back the Revisions and replicas window.
Select Refresh to see your new revision in the list.
Wait for the deployment to fail as reported by the Running status column.

5. Roll back to fix your app

Go to the Azure portal, search for and select SRE Agent.
Select my-aca-sre-agent from the list to open a chat environment.
In the chat box, give your agent the following command and wait for a response.
```
What's wrong with my-container-app?
```
From here, the agent recognizes that the tag name is invalid.

While every chat session is different, you should see a response that resembles the following response.
⚠️ I found a potential issue with crs-aca-app:
- The container image specified is: mcr.microsoft.com/k8se/quickstart:latest1
This image tag (latest1) looks unusual. The typical image tag is latest, not latest1. If this image does not exist in the registry, your container app will fail to pull and start the container, even though the provisioning state may show as "Succeeded" and the status as "Running" at the platform level.

Recommendation: Check and update the container image reference for crs-aca-app to use a valid tag (such as latest) if latest1 is not intentional or does not exist.

Would you like help correcting the image tag or need to investigate further into logs or events for this app?
In the chat box, respond with yes to approve the request to fix the problem.

If your agent doesn't respond with a "yes or no" question, you can give your agent the following command and wait for a response.
```
Rollback to the last working version.
```
As the agent concludes the rollback analysis, it asks you for approval to execute the rollback operation.

Select Approve to approve the action to fix your container app.

After the rollback is successful, you should see a response similar to:

✅ The container app my-container-app is now healthy! The image was successfully updated and the app is running with 1 ready replica.

6. Verify repair

Now you can prompt your agent to return your app's fully qualified domain name (FQDN) so you can verify a successful deployment.

In the chat box, enter the following prompt.

What is the FQDN for this container app?

Format your response as a clickable link.

To verify your container app is working properly, select the link to open your app in a web browser.

Clean up resources

If you're not going to continue to use this application, you can delete the container app and all the associated services by removing the resource groups created in this article.

Execute the following steps for both the my-aca-app-group and my-sre-agent-group resource groups.

Go to the resource group in the Azure portal.
From the Overview section, select Delete resource group.
Enter the resource group name in the confirmation dialog.
Select Delete.

The process to delete the resource group can take a few minutes to complete.

Share via