Azure Weekly CW11: SRE Agent Updates, PostgreSQL IaC GA & Microsoft 365 E7

This week in Azure

No new videos from John this week. He was in Europe for the Italy and Paris AI tour events, back to normal next week. The channel hit 400,000 subscribers while he was on a bus to the airport, and there’s an AMA on March 24 at 8:00 a.m. PST.

PostgreSQL dominates this week with three separate updates for the flexible server. The elastic cluster IaC support going GA is the one I care about most. The SRE Agent and M365 E7 are the other two worth your time.

Azure SRE Agent new capabilities

The Azure SRE Agent picked up new features. It’s an AI-powered operations agent with a customizable level of autonomy. You can have it just recommend things, or let it automate actions directly to keep your services up and reduce incident impact.

The scale numbers are interesting: over 1,300 agents deployed today, more than 35,000 incidents mitigated. Anything you can do with a CLI, this agent can do too.

It has built-in knowledge of Azure, can run on a schedule or trigger from incidents, and uses multiple OpenAI and Anthropic models for its reasoning. The interesting part is the autonomy dial: you set how much freedom it gets, from “just tell me what to do” to “go fix it.”

Private AWS S3 to Azure Blob migration

Azure Storage Mover can now migrate data from AWS S3 buckets to Azure Blob Storage over private connectivity. Previously, the transfer happened over the public network.

Before:
  AWS S3 ──→ (public internet) ──→ Azure Blob Storage

After:
  AWS S3 ──→ VPC (AWS) ──→ Private Endpoint (Azure) ──→ Azure Blob Storage
              └── private connectivity end to end ──┘

You create a private connection that uses the VPC on the AWS side and private endpoints on the Azure side. The data never touches the public internet. If you’re moving sensitive data between clouds and public transfer was a blocker, this removes that obstacle.

VS Code MSSQL query profiler (preview)

The VS Code MSSQL extension keeps swallowing more database tooling. The query profiler is now in preview. You can watch how your SQL queries execute in real time, spot performance problems, and figure out what’s slow, all without leaving VS Code.

The profiler works with SQL Server on-premises, SQL Server running in the cloud, and Azure SQL Database. If you’ve been jumping between VS Code and SSMS just for query profiling, one less reason to switch. The MSSQL extension has been accumulating features fast. The backup/restore and database management capabilities from CW9 are already in preview, and the query profiler adds another piece of what used to be SSMS-only functionality.

PostgreSQL Flexible Elastic Cluster IaC (GA)

PostgreSQL Flexible Server elastic clusters now support infrastructure as code with Terraform, Bicep, and Ansible. This is GA.

Elastic clusters use the Citus extension to distribute your PostgreSQL data across multiple nodes. Until now, managing these clusters through IaC was not officially supported.

Developer ──→ Write IaC template (Terraform / Bicep / Ansible)
                    │
                    ▼
              Git repository
                    │
                    ▼
              CI/CD pipeline ──→ Deploy elastic cluster
                                      │
                                 ┌────┴────┐
                                 Node 1  Node 2  Node N
                                 (Citus distributed)

Now you can manage your elastic cluster in the same CI/CD pipeline as everything else. Write the template, check it into your repo, let the pipeline deploy. If you’ve been managing elastic clusters by hand in production, it’s time to stop.

PostgreSQL Flexible built-in Grafana dashboards

PostgreSQL Flexible Server now has built-in Grafana dashboards accessible from the Azure portal. No need to set up a separate Grafana instance.

You no longer need to spin up and maintain a separate Grafana instance just to see how your database is doing. If you want quick visibility without building a monitoring stack, it works out of the box.

PostgreSQL Flexible Premium SSDv2 customer-managed keys

If you’re running PostgreSQL Flexible Server on Premium SSD v2 disks, you can now use customer-managed keys (CMK) for encryption. The encryption key lives in your Azure Key Vault, and you control the rotation schedule.

If your compliance requirements say you need to own the encryption keys, this was previously a reason not to use Premium SSD v2 with PostgreSQL. Now you can have both. Rotate on whatever schedule your policies demand.

Azure Monitor retry bin

Azure Monitor now supports a retry bin for batch aggregations in Log Analytics. If a batch aggregation fails, you can rerun a specific batch by specifying the lookback time range and aggregation interval.

Normal flow:
  Data ──→ Batch aggregation ──→ Aggregated results
                │
            (failure)
                │
                ▼
Before:   Gap in aggregation data. Manual workaround needed.

After:    Retry bin ──→ Rerun specific batch
                           (lookback + interval)
                              ──→ Gap filled

The built-in retry handles most transient failures on its own. The retry bin is for when even that fails and you’re staring at a gap in your data. Specify the time window, rerun, gap filled. Beats rebuilding aggregation data by hand.

Microsoft 365 E7 and Agent 365

The big licensing announcement this week: Microsoft 365 E7 and the standalone Agent 365 SKU.

Agent 365 is a per-user, per-month license that covers governance for AI agents. Think of it this way: just as employees get Entra protection, risk detection, conditional access, Purview protections, and Defender protections, Agent 365 gives you the same controls for your agentic identities.

E7 bundles E5, Microsoft 365 Copilot, Entra Suite, and Agent 365 into a single per-user, per-month license. If you’re already paying for E5 and Copilot separately, E7 consolidates the billing and adds the agentic governance layer on top.

Copilot Cowork (preview)

Copilot Cowork is a new agent inside M365 Copilot. You give it a high-level ask, it builds a plan and works through it. What makes it different from a regular prompt is that it’s grounded in Work IQ, Microsoft’s term for the graph of how you actually work: your emails, meetings, the people you collaborate with, documents, SharePoint.

You: "Prepare a quarterly review for the infrastructure team"

Copilot Cowork:
  1. Pulls relevant data from your emails, meetings, SharePoint
  2. Identifies stakeholders from your collaboration patterns
  3. Creates a plan with discrete steps
  4. Executes the plan (drafts, documents, summaries)
  5. Reports progress, lets you adjust along the way

Because it knows your work patterns and who you work with, the results should be more useful than a cold prompt. You check progress, adjust as needed, and it keeps going. Once enabled for your tenant, it shows up as another agent in M365 Copilot.

Final thoughts

Three PostgreSQL updates in one week tells you where Microsoft is putting its database effort. The elastic cluster IaC going GA matters most. Every manual change to a distributed cluster is risk you don’t need to carry, and now Terraform, Bicep, and Ansible can handle it.

The private S3-to-Blob migration option will quietly unblock a lot of projects. “It goes over the public internet” was a hard no for anyone moving sensitive data between clouds. That excuse is gone now.

And the M365 E7 and Agent 365 story is worth watching. Microsoft is treating agentic identities the same way it treats employee identities: with Entra, Purview, Defender, conditional access. If you’re deploying AI agents without that kind of governance, you probably should be.

Sources

1. John Savill, “Azure Update - 13th March 2026,” YouTube, https://www.youtube.com/watch?v=17uHDPjdkto