> ## Documentation Index
> Fetch the complete documentation index at: https://docs.komodor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Investigator

> Investigates an Azure subscription across Resource Graph, Monitor, Log Analytics and AKS, and cites portal deeplinks for every finding.

Deploy this agent when an incident is in an Azure subscription and you want it traced across
inventory, metrics and logs in one pass. It reads Azure directly and returns structured findings
that link back into the portal. This page covers what it reaches, what to connect first, and where
it stops.

## What it does

You give it an incident description and the questions you want answered. It locates the affected
resources, reads their metrics and logs, and correlates what it finds into structured findings —
each one carrying a portal deeplink so the evidence can be opened rather than taken on trust.

## What it reads

All of it read-only. The five capabilities below were measured against a plain Reader role, not
assumed from documentation.

| Source          | What it uses it for                                                  |
| --------------- | -------------------------------------------------------------------- |
| Resource Graph  | Finding the affected resources and their relationships               |
| Monitor         | Metrics across the incident window                                   |
| Log Analytics   | Log queries, in KQL                                                  |
| AKS             | Cluster metadata, when the workload is on Kubernetes                 |
| Cost Management | Spend signals, when the symptom is financial rather than operational |

## Before you deploy

| Requirement      | Detail                                                | Where to set it up                                                       |
| ---------------- | ----------------------------------------------------- | ------------------------------------------------------------------------ |
| Model access     | The managed model gateway, or your own Claude API key | [Credentials & secrets](/manage-your-agents/build/credentials-secrets)   |
| Azure connection | Read-only access across the five capabilities above   | [Built-in integrations](/manage-your-agents/build/built-in-integrations) |

<Note>
  Unlike the Datadog and Grafana investigators, this agent has no MCP Gateway path. Azure publishes no
  hosted MCP endpoint, so there is no remote server for the gateway to be bound to and no group to
  pick — the agent's Azure tooling runs alongside it, configured from the connection you select.
</Note>

## Ask it for

In chat, or as a run's prompt:

```text theme={null}
The orders-api AKS workload in subscription prod-weu started failing readiness at
08:30 UTC. Check what changed on the cluster and its dependencies, read the Log
Analytics errors for that window, and tell me what is responsible.
```

When a workflow drives it instead of a person, it takes the same structured envelope the other
investigators take — `incident_description`, `questions`, `affected_services`,
`investigation_start`, `context` and `budget_seconds`.

## Defaults and limits

|             |                                          |
| ----------- | ---------------------------------------- |
| Catalog ID  | `azure-investigator`                     |
| Model       | `claude-sonnet-4-6`                      |
| Time budget | 600 seconds, adjustable 120–1800 per run |
| Deployment  | Komodor cloud or self-hosted             |
| Chat        | Yes                                      |

The time budget degrades rather than fails. At 70% the agent is nudged to converge; at 100% further
tool calls are refused and it reports what it has.

## In a workflow

This is a specialist, not a lead. An orchestrator delegates the Azure slice of an incident to it and
synthesizes its findings with other specialists' work. Where a workload spans Azure and Kubernetes,
pairing it with a cluster investigator covers both halves.

See [Orchestration](/manage-your-agents/run/orchestration) for how a step delivers work to it.

## What it will not do

It never changes anything in Azure. It has no mutating tool, so it cannot restart a resource, edit
a configuration or adjust a scaling rule.

It sees one subscription's worth of evidence, bounded by what the connection's role permits. Where a
capability is not granted, it reports the gap instead of inferring around it.

## Next steps

<CardGroup cols={2}>
  <Card title="Built-in integrations" href="/manage-your-agents/build/built-in-integrations">
    Create the Azure connection this agent uses.
  </Card>

  <Card title="AWS Infrastructure Investigator" href="/manage-your-agents/build/catalog/aws-investigator">
    The same investigation shape, over AWS.
  </Card>

  <Card title="Runs & evidence" href="/manage-your-agents/run/runs-evidence">
    Read the tool calls behind a finding.
  </Card>

  <Card title="Agent catalog" href="/manage-your-agents/build/catalog/overview">
    Every catalog agent, side by side.
  </Card>
</CardGroup>


## Related topics

- [Agent catalog](/manage-your-agents/build/catalog/overview.md)
- [Use specialized agents](/manage-your-agents/build/use-specialized-agents.md)
- [Cluster Investigator](/manage-your-agents/build/catalog/cluster-investigator.md)
- [Grafana Investigator](/manage-your-agents/build/catalog/grafana-investigator.md)
- [Klaudia Investigator](/manage-your-agents/build/catalog/klaudia-investigator.md)