From alerts to action: How AI agents are reshaping network operations at Microsoft

A network connectivity incident doesn’t begin when someone asks whether they can get online. It starts earlier, with the signals coming from routers, switches, access points, circuits, and the tools that watch them.

“We have different tools to detect if there’s some outage in the network. After we have those alerts converted into tickets, we work to make sure the corporate network gets back up and running.”

Neeraj Mohan, senior site reliability engineering manager, Microsoft Digital

At the scale of Microsoft, a company with more than 900 sites, 500 datacenters, and tens of thousands of network devices, those incidents translate into thousands of tickets. And each ticket requires some combination of decision making, action, collaboration, and communication.

Managing connectivity for that internal network falls to Microsoft Digital, the company’s IT organization.

“We’re like a backbone for supporting the business,” says Neeraj Mohan, a site reliability engineering manager in Microsoft Digital. “We have different tools to detect if there’s some outage in the network. After we have those alerts converted into tickets, we work to make sure the corporate network gets back up and running.”

Through agentic AI, we’re changing how that work gets done. Instead of asking people to chase every diagnostic, status update, ticket handoff, and stakeholder question, our teams are building AI agents that can sense what’s happening, act within clear limits, and validate outcomes before we do the work.

The labor behind every alert

Network operations has always depended on strong tooling, disciplined processes, and experienced engineers. The challenge is that the volume of work keeps rising.

The Microsoft environment includes more than 75,000 devices, over 300,000 users, and in excess of 1 million connected endpoints. The monthly volume of tickets that require human intervention rose as high as 70,000 in January 2025. Eighteen months later, we’d reduced it to less than half—about 27,000—through the application of automation and AI.

That showed great progress, but this many tickets a month still demands a lot of effort. Many of these tickets require enrichment to provide engineers with information like the current device state, neighboring device status, links, logs, and prior troubleshooting. Others require coordination with internal teams, datacenter operations, site services, telecommunications providers, or network device vendors.

The difficult aspect isn’t just the technical fix. It’s the time spent changing context from one system to another, checking partner portals, scheduling work windows, answering leadership questions, and validating whether a fix has actually restored service.

To make matters more complicated, we can’t let just anyone log in to network devices or run changes in a secure environment. We need to design read access, execution permissions, and human approvals deliberately.

To address these challenges, we looked across the incident lifecycle, reviewed ticket volume and manual effort, and prioritized agent opportunities based on impact, user need, and development effort. The first set of agents focused on three connected problems: dynamic troubleshooting, cross-system handoffs, and outage communications.

Three agents, one operating model

The network operations agents we’ve created aren’t a single monolithic utility. They’re a set of focused tools that map to how operations work already happens. We created them using first-party, cloud-based technologies that include Microsoft Azure OpenAI, Microsoft Foundry, Microsoft Agent Framework, Microsoft Copilot Studio, and Microsoft Teams, and then integrated them into our internal incident management (ICM) tool.

Each agent sits close to the work, respects the permissions required for network operations, and gives engineers or stakeholders the next useful action without forcing them to assemble context manually.

Falcon Agent: Fresh diagnostics on demand

Falcon Agent is the action engine in our AI network operations loop. Before this expansion of agentic capabilities, Falcon already supported automated troubleshooting and remediation for known scenarios like access-point-down incidents. A service line could onboard a scenario once, define the troubleshooting steps, and let Falcon handle repeat tickets without asking a directly responsible individual (DRI) to rerun the same actions every time.

The Falcon Agent adds an on-demand layer. If Falcon has already run a workflow and a DRI starts work later in the day, the earlier results might be stale.

“We want to be where the users are. Falcon Agent is available through Teams and the incident management tool, giving engineers a choice of where to work while keeping the controls in place.”

Shayoni (mononym only), product manager 2, Microsoft Digital

With the agent, authorized engineers can refresh troubleshooting, retrieve current logs, check device reachability, validate service restoration, and enrich the ticket with updated information. By the time an engineer opens a ticket, the agent has already refreshed and summarized the ticket.

Falcon Agent also restricts executional prompts to the right engineering users on secure admin workstations (SAWs). Meanwhile, informational prompts can serve a broader audience without exposing device-level control.

“We want to be where the users are,” says Shayoni, a product manager for Falcon in Microsoft Digital. “Falcon Agent is available through Teams and the incident management tool, giving engineers a choice of where to work while keeping the controls in place.”

Smart Bonding Agent: Closing the handoff gap

We can’t fix every incident remotely. If we need to restart a router on site, reseat a cable, access a power supply, or call in a telecommunications provider for a fiber cut, the work shifts from remediation to coordination. That’s where the Smart Bonding Agent comes in.

“This agent provides for lifecycle continuity across systems. It closes the handoff gaps where we would often lose context in the past.”

Suvodip Moitra, senior product manager, Microsoft Digital

The Smart Bonding Agent contains several flows:

• A recommendation agent reviews the incident and identifies the likely issue and the team to engage.
• A ticket steward agent creates the right ticket after human approval and monitors updates.
• A work-window scheduling flow helps connect the right people when the receiving team needs help from Microsoft engineers.

The goal is to keep the engineer in the incident record instead of asking them to jump across portals, emails, and partner systems. At the same time, human approval is intentional by design. We don’t want to reduce one team’s work by flooding a partner with unnecessary tickets.

“This agent provides for lifecycle continuity across systems,” says Suvodip Moitra, a senior product manager responsible for the Smart Bonding Agent in Microsoft Digital. “It closes the handoff gaps where we would often lose context in the past.”

As confidence improves, lower-risk workflows can move toward more automation. The agent already covers Global Datacenter Operations and Puget Sound Network Operations, with expansion underway across more issue types, telecommunications providers, and network device vendors.

Network Outage Insights Agent: Less talk, faster restoration

When a site has a network problem, engineers aren’t the only people who need information.

IT managers want to know whether their location has connectivity. Leaders are responsible for answering to business stakeholders. Help-desk teams need to know whether an employee issue is local to a device or tied to a site-level outage.

“Part of our role is knowing the people we support. This agent helps us understand who we’re serving and what the best forums are where we can interact with them, all in one place.”

Laxman Bhinnale, senior technical program manager, Microsoft Digital

Built on Copilot Studio, the Network Outage Insights Agent supports both push and pull communications. It can send targeted Teams notifications to impacted IT managers on the push side and answer natural-language queries when people need to pull answers.

An IT leader might ask, “Are there any active site outages on my campus?” The agent returns the incident link, current status, estimated time to resolve, impact, region-level details, and historical trends that can help teams spot recurring issues with a site or provider.

The agent also changes how the team learns. It can track feedback in a backlog and connect improvements back to the people who requested them.

“Part of our role is knowing the people we support,” says Laxman Bhinnale, a senior technical program manager in Microsoft Digital. “This agent helps us understand who we’re serving and what the best forums are where we can interact with them, all in one place.”

Great results, exciting opportunities

The measurable impact of our AI network operations agents is still emerging, but the signals of success are clear.

Falcon Agent users report saving around 300 hours in the first few months of operation, equating to 10–15 minutes saved per ticket. The agent has a 60% retention rate and 100% positive user feedback.

We’ve observed that Falcon can handle about 60% of total incident volume already, with an expectation it can reach about 80% as more scenarios mature. The remaining work is likely to include physical or cross-team activity where the Smart Bonding Agent is a better fit.

Meanwhile, our Network Outage Insights dashboard showed 149 outages in one month, with 32 hours saved on communications and reporting.

“The future is multi-agent orchestration: monitoring, troubleshooting, partner engagement, and communication working together.”

Raghavendran Loganathan, principal software engineering manager, Microsoft Digital

The next step is connecting these agents’ efforts. In future flows, the Smart Bonding Agent will be able to engage the right internal or external party while Falcon Agent validates that the issue is resolved. Finally, Outage Agent Insights will communicate impact and recovery status before a post-incident agent generates the postmortem. Each agent keeps its focus, but the work moves as one incident lifecycle.

“The future is multi-agent orchestration: monitoring, troubleshooting, partner engagement, and communication working together,” says Raghavendran Loganathan, a principal software engineering manager in Microsoft Digital.

For our customers, the lesson is that you don’t need to copy our exact network or ticketing model. Instead, study your own top sources of work. Analyze telemetry and see what constitutes your most significant pain points, then try to attack the problem with agents.

That’s the practical pattern: Start with the work that repeats, put agents where people already operate, keep humans in the loop in places where actions carry risk, and measure whether the agent changes real behavior. At Microsoft scale, that’s meant fewer stale tickets, fewer missed handoffs, clearer communications, and more engineering time spent on restoring service so the company can achieve at top performance.