Run modes in Azure SRE Agent

Run modes control whether your agent asks for approval before taking actions or acts on its own. The key distinction is between Azure infrastructure operations (which have system-enforced approval) and other actions.

Two modes

The following table summarizes the two available modes:

Review mode

Review is the default mode. Your agent investigates, identifies a fix, and asks for your approval before executing Azure infrastructure operations (Azure CLI commands, Azure Resource Manager operations, and similar write actions).

The following example shows what you see for Azure infrastructure actions:

I found that app-service-prod is running slowly due to high memory usage.

Proposed action: Restart App Service 'app-service-prod'
This may cause brief downtime (30-60 seconds).

[Approve] [Deny]

Select Approve to execute the proposed action, or Deny to stop it. Only SRE Agent Administrators can approve actions.

Autonomous mode

In autonomous mode, your agent investigates and executes actions without waiting for approval. Use this mode when you trust the agent to handle the situation.

The following example shows what you see in autonomous mode:

I found app-service-staging was running slowly.

Done: I've restarted app-service-staging. Memory usage is now normal.

Where to configure run modes

Set run modes per response plan and per scheduled task. You don't set run modes at the agent level.

Set the Agent autonomy level when you create or edit a response plan or task:

Agent-level default

Settings > Basics shows the agent's global mode. Set this mode when you create the agent (defaults to Review). It serves as the fallback when no per-response-plan or per-task mode is set.

Recommendations

The following table provides guidance for choosing the right mode based on your scenario:

Start with review mode. Observe what the agent recommends for two to four weeks. When you find patterns you consistently approve, switch those specific triggers to Autonomous.

How permissions interact with run modes

The agent behaves differently depending on the assigned permissions, the execution mode, and the type of action it attempts to make. In all cases, if the agent doesn't have the required permissions, it requests temporary access through Microsoft Entra OBO flow.

Read-only actions

The following table details how the agent behaves when it attempts a read-only operation that requires elevated permissions.

Write actions

The following table explains how the agent behaves when it tries to perform a write operation.