{"id":25418,"date":"2026-09-10T09:00:00","date_gmt":"2026-09-10T16:00:00","guid":{"rendered":"https:\/\/cm-edgetun.pages.dev\/insidetrack\/blog\/?p=25418"},"modified":"2026-09-09T16:36:42","modified_gmt":"2026-09-09T23:36:42","slug":"from-alerts-to-action-how-ai-agents-are-reshaping-network-operations-at-microsoft","status":"publish","type":"post","link":"https:\/\/cm-edgetun.pages.dev\/insidetrack\/blog\/from-alerts-to-action-how-ai-agents-are-reshaping-network-operations-at-microsoft\/","title":{"rendered":"From alerts to action: How AI agents are reshaping network operations at Microsoft"},"content":{"rendered":"\n

A network connectivity incident doesn\u2019t begin when someone asks whether they can get online. It starts earlier, with the signals coming from routers, switches, access points, circuits, and the tools that watch them.<\/p>\n\n\n\n

\"A<\/figure>\n\n\n\n
\n

\u201cWe have different tools to detect if there\u2019s some outage in the network. After we have those alerts converted into tickets, we work to make sure the corporate network gets back up and running.\u201d<\/p>\nNeeraj Mohan, senior site reliability engineering manager, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n

At the scale of Microsoft, a company with more than 900 sites, 500 datacenters, and tens of thousands of network devices, those incidents translate into thousands of tickets. And each ticket requires some combination of decision making, action, collaboration, and communication.<\/p>\n\n\n\n

Managing connectivity for that internal network falls to Microsoft Digital, the company\u2019s IT organization.<\/p>\n\n\n\n

\u201cWe\u2019re like a backbone for supporting the business,\u201d says Neeraj Mohan, a site reliability engineering manager in Microsoft Digital. \u201cWe have different tools to detect if there\u2019s some outage in the network. After we have those alerts converted into tickets, we work to make sure the corporate network gets back up and running.\u201d<\/p>\n\n\n\n

Through agentic AI, we\u2019re changing how that work gets done. Instead of asking people to chase every diagnostic, status update, ticket handoff, and stakeholder question, our teams are building AI agents that can sense what\u2019s happening, act within clear limits, and validate outcomes before we do the work.<\/p>\n\n\n\n

The labor behind every alert<\/h2>\n\n\n\n

Network operations has always depended on strong tooling, disciplined processes, and experienced engineers. The challenge is that the volume of work keeps rising.<\/p>\n\n\n\n

The Microsoft environment includes more than 75,000 devices, over 300,000 users, and in excess of 1 million connected endpoints. The monthly volume of tickets that require human intervention rose as high as 70,000 in January 2025. Eighteen months later, we\u2019d reduced it to less than half\u2014about 27,000\u2014through the application of automation and AI.<\/p>\n\n\n\n

That showed great progress, but this many tickets a month still demands a lot of effort. Many of these tickets require enrichment to provide engineers with information like the current device state, neighboring device status, links, logs, and prior troubleshooting. Others require coordination with internal teams, datacenter operations, site services, telecommunications providers, or network device vendors.<\/p>\n\n\n\n

The difficult aspect isn\u2019t just the technical fix. It\u2019s the time spent changing context from one system to another, checking partner portals, scheduling work windows, answering leadership questions, and validating whether a fix has actually restored service.<\/p>\n\n\n\n

To make matters more complicated, we can\u2019t let just anyone log in to network devices or run changes in a secure environment. We need to design read access, execution permissions, and human approvals deliberately.<\/p>\n\n\n\n

To address these challenges, we looked across the incident lifecycle, reviewed ticket volume and manual effort, and prioritized agent opportunities based on impact, user need, and development effort. The first set of agents focused on three connected problems: dynamic troubleshooting, cross-system handoffs, and outage communications.<\/p>\n\n\n\n

Three agents, one operating model<\/h2>\n\n\n\n

The network operations agents we\u2019ve created aren\u2019t a single monolithic utility. They\u2019re a set of focused tools that map to how operations work already happens. We created them using first-party, cloud-based technologies that include Microsoft Azure OpenAI, Microsoft Foundry, Microsoft Agent Framework, Microsoft Copilot Studio, and Microsoft Teams, and then integrated them into our internal incident management (ICM) tool.<\/p>\n\n\n\n

Each agent sits close to the work, respects the permissions required for network operations, and gives engineers or stakeholders the next useful action without forcing them to assemble context manually.<\/p>\n\n\n\n

Falcon Agent: Fresh diagnostics on demand<\/h3>\n\n\n\n

Falcon Agent is the action engine in our AI network operations loop. Before this expansion of agentic capabilities, Falcon already supported automated troubleshooting and remediation for known scenarios like access-point-down incidents. A service line could onboard a scenario once, define the troubleshooting steps, and let Falcon handle repeat tickets without asking a directly responsible individual (DRI) to rerun the same actions every time.<\/p>\n\n\n\n

The Falcon Agent adds an on-demand layer. If Falcon has already run a workflow and a DRI starts work later in the day, the earlier results might be stale.<\/p>\n\n\n\n

\"A<\/figure>\n\n\n\n
\n

\u201cWe want to be where the users are. Falcon Agent is available through Teams and the incident management tool, giving engineers a choice of where to work while keeping the controls in place.\u201d<\/p>\nShayoni (mononym only), product manager 2, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n

With the agent, authorized engineers can refresh troubleshooting, retrieve current logs, check device reachability, validate service restoration, and enrich the ticket with updated information. By the time an engineer opens a ticket, the agent has already refreshed and summarized the ticket.<\/p>\n\n\n\n

Falcon Agent also restricts executional prompts to the right engineering users on secure admin workstations (SAWs). Meanwhile, informational prompts can serve a broader audience without exposing device-level control.<\/p>\n\n\n\n

\u201cWe want to be where the users are,\u201d says Shayoni, a product manager for Falcon in Microsoft Digital. \u201cFalcon Agent is available through Teams and the incident management tool, giving engineers a choice of where to work while keeping the controls in place.\u201d<\/p>\n\n\n\n

Smart Bonding Agent: Closing the handoff gap<\/h3>\n\n\n\n

We can\u2019t fix every incident remotely. If we need to restart a router on site, reseat a cable, access a power supply, or call in a telecommunications provider for a fiber cut, the work shifts from remediation to coordination. That\u2019s where the Smart Bonding Agent comes in.<\/p>\n\n\n\n

\"A<\/figure>\n\n\n\n
\n

\u201cThis agent provides for lifecycle continuity across systems. It closes the handoff gaps where we would often lose context in the past.”<\/p>\nSuvodip Moitra, senior product manager, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n

The Smart Bonding Agent contains several flows:<\/p>\n\n\n\n