Azure Copilot Observability Agent Chat: From Manual KQL to Conversational Insight

What changed

Azure Monitor’s Observability Agent has been upgraded with a chat experience that lets engineers ask plain‑language questions about logs, metrics, and traces. The agent parses the request, generates the appropriate Kusto Query Language (KQL) statements, runs them across all linked data stores, and returns a concise, data‑backed answer—complete with visualizations and a visible query chain.

Key functional shifts include:

• No more manual KQL – the agent writes, runs, and explains the query for you.
• Cross‑store correlation – a single prompt can pull data from Log Analytics workspaces, Azure Metrics, Application Insights, and Azure Data Explorer.
• Progressive exploration – each follow‑up builds on the previous context, preserving a clear audit trail of the reasoning steps.
• Deep investigation mode – a single command triggers an automated root‑cause analysis that maps related resources, surfaces anomalies, and produces a recommendation report.

The feature is currently accessed via the Logs blade in the Azure portal (see ) and will roll out to other Azure observability experiences such as Metrics Explorer and Application Insights.

---

Provider comparison

Feature	Azure Copilot Observability Agent	AWS DevOps Guru + CloudWatch Insights	Google Cloud Ops Agent + Vertex AI Observability
Interaction model	Natural‑language chat in Azure portal; optional deep‑investigation command	Primarily console‑based recommendations; limited chat via Amazon Q (preview)	Conversational UI in Cloud Console via Vertex AI Assistant (beta)
Query generation	Generates KQL for Log Analytics and Kusto‑based stores	Generates CloudWatch Logs Insights queries (SQL‑like)	Generates BigQuery‑style queries for Cloud Logging
Multi‑store awareness	Unified view across Log Analytics, Metrics, Application Insights, Azure Data Explorer	Separate views for CloudWatch Logs, Metrics, X‑Ray; limited cross‑service correlation	Unified view across Cloud Logging, Cloud Monitoring, and Trace, but requires manual linking
Explainability	Shows the exact KQL used and a step‑by‑step chain of thought	Shows recommendation rationale but not raw queries	Shows generated SQL and confidence scores, but UI is less transparent
Deep investigation	One‑click “Run deep investigation” that produces a PDF report with root‑cause analysis	DevOps Guru automatically surfaces insights; no on‑demand deep dive UI	Vertex AI Observability can run a Cause‑Analysis Pipeline, but requires custom configuration
Pricing model	Included with Azure Monitor Standard tier; additional Copilot usage billed per 1,000 chat turns (≈ $0.002)	CloudWatch Logs Insights priced per GB scanned; DevOps Guru free tier then $0.002 per insight	Logging ingestion priced per GB; Vertex AI Assistant usage billed per token (≈ $0.0004 per 1k tokens)
Data residency & security	Operates within the same subscription and RBAC scope as the data source	Separate IAM roles; cross‑account access requires explicit trust policies	Uses Google Cloud IAM; cross‑project access needs Service Account delegation
Language support	English + multilingual auto‑translation (shown examples in Spanish, Japanese)	English only (Q preview adds limited languages)	Multilingual support via Vertex AI models

Pricing implications

For most enterprises, the incremental cost of the chat layer is modest. Azure Monitor already charges for data ingestion and retention; the Copilot overlay adds a per‑turn fee that only becomes material at very high conversational volumes (e.g., > 500 k turns per month). By contrast, AWS’s model charges per GB of logs scanned, which can spike when analysts run ad‑hoc queries. Google’s token‑based pricing is comparable to Azure’s per‑turn fee but adds the cost of the underlying BigQuery scans.

Cost‑optimization tip: Enable log sampling and retention policies before the chat layer is activated. The agent can only query what is stored, so trimming unnecessary logs reduces both storage and query‑execution costs across all three clouds.

---

Migration considerations

1. Assess data source compatibility

Azure	AWS	GCP
Log Analytics workspace (Kusto)	CloudWatch Logs (Insights)	Cloud Logging (BigQuery export)
Application Insights	X‑Ray & CloudWatch ServiceLens	Cloud Trace
Azure Data Explorer	Amazon OpenSearch (optional)	BigQuery

If your organization already uses Azure Monitor for logs and metrics, the migration path is straightforward: enable the Observability Agent on each resource, grant the Monitoring Reader role to the agent’s managed identity, and start chatting. For hybrid environments, you can connect Azure Monitor to external data sources via Azure Data Explorer’s federation or Log Analytics data connectors, allowing the agent to query AWS CloudWatch logs that have been streamed into a Log Analytics workspace.

2. Identity & access management

• Azure: The agent respects the same RBAC permissions you assign to the user. Ensure the managed identity AzureObservabilityAgent has at least Log Analytics Reader on the workspace and Metrics Reader on the target resources.
• AWS: To replicate the experience, you would need to grant the DevOps Guru service role cloudwatch:Read and xray:Read across accounts. No native chat identity exists yet.
• GCP: Vertex AI Assistant uses a service account with logging.viewer and monitoring.viewer scopes.

3. Data model alignment

KQL and CloudWatch Logs Insights have different syntax and functions. When moving workloads from AWS to Azure, consider exporting CloudWatch logs to an Azure Storage account and then ingesting them into Log Analytics via the Azure Monitor HTTP Data Collector API. This preserves field names and timestamps, allowing the Copilot agent to generate accurate queries without extensive schema mapping.

4. Pilot and governance

1. Pilot the chat on a low‑traffic resource (e.g., a staging web app). Capture the generated KQL statements and verify they respect data residency policies.
2. Governance – enable the Observability Agent audit log (available in Azure Activity Log) to track who asked which question and what queries were executed. This satisfies compliance requirements for regulated industries.
3. Feedback loop – use the built‑in Give Feedback button to report mis‑interpretations; the model is continuously refined based on real‑world usage.

---

Business impact

Faster mean‑time‑to‑resolution (MTTR)

The chat interface eliminates the learning curve of KQL for many operators, allowing frontline engineers to surface error spikes (“What errors increased in the last 24 hours?”) in seconds rather than minutes. Early internal tests show a 30‑40 % reduction in MTTR for incident triage.

Democratization of observability

Non‑technical stakeholders—product managers, security analysts, compliance officers—can now query production telemetry without a dedicated monitoring team. The multilingual prompt handling demonstrated in the preview (Spanish and Japanese examples) expands accessibility across global teams.

Cost predictability

Because the agent surfaces the underlying query, teams can audit expensive scans and adjust retention policies proactively. This transparency drives more disciplined data‑collection practices, ultimately lowering storage and query‑execution spend.

Strategic alignment

Adopting a conversational observability layer aligns with broader AI‑assisted operations initiatives. It creates a unified entry point for future integrations such as automated remediation bots (e.g., Azure Logic Apps that trigger a scale‑out when the agent detects a latency anomaly).

---

Next steps for adopters

1. Enable the agent on a production Log Analytics workspace via the Azure portal (Logs → Observability agent).
2. Run a set of pilot questions (error trends, latency anomalies, dependency failures) and capture the generated KQL for internal review.
3. Configure deep investigation on a critical service to evaluate the automated root‑cause report.
4. Compare costs against your existing CloudWatch Insights or BigQuery usage to validate the economic benefit.
5. Plan a phased rollout that includes RBAC reviews, audit‑log enablement, and feedback collection.

By shifting the first step of observability from “write a query” to “ask a question,” Azure Copilot Observability Agent positions itself as a practical bridge between raw telemetry and actionable insight—while keeping pricing transparent and migration pathways clear.

---

Stay tuned for upcoming webinars and the next preview that will add multi‑cloud federation capabilities, allowing the agent to query AWS and GCP data sources directly from the Azure portal.