Executive Summary

Microsoft’s Mission Critical Services for Azure Platform (MCSAP) team powers incident response with Microsoft Agent Framework, which unifies Microsoft Research’s AutoGen with the enterprise-ready Semantic Kernel. Root cause analyses that once took up to two hours are now generated in seconds.[1] The team has also cut low-risk incident volume by up to 40%, all without adding headcount.[2]

From Research to Production

Microsoft Agent Framework unifies two lineages that used to live separately. One side of the coin is AutoGen, a Microsoft Research project that pioneered experimental multi-agent orchestration patterns, exploring how multiple AI agents could collaborate, reason, and hand off work to one another rather than operating as a single monolithic model. The other side is Semantic Kernel, the stable, enterprise-ready SDK that gave developers connectors into enterprise systems, content moderation, and telemetry. By consolidating both into a single framework, Microsoft brought research-grade orchestration and production-grade stability together in one foundation now used to build agentic systems across Microsoft and its customers at enterprise scale.

The MCSAP team is responsible for critical incident management and problem resolution for Microsoft’s largest Azure customers and, watched this maturation firsthand. Its engineers had already built and run a multi-agent system on Semantic Kernel for six months before concluding they needed something different.

“We started with Semantic Kernel, but we saw a lot of things AutoGen was providing out of the box that Semantic Kernel wasn’t, especially around orchestration. When we moved to Microsoft Agent Framework, the built-in workflows, the node-and-edge orchestration, fan-out and fan-in, were the best things. Evals, orchestration, and memory management, especially with native Cosmos DB integration, are the biggest wins.”

–Sai Teja Nagamothu, Senior Azure ACE Engineer, Azure Engineering Direct

The team weighed alternatives, including LangChain, LangGraph, and the GitHub Copilot SDK, before settling on Microsoft Agent Framework. Handling sensitive customer data made a Microsoft-native stack the safer choice, and Microsoft Agent Framework’s flexibility, deployable in a web app, in containers, anywhere the team needed it, gave MCSAP a foundation it could build on without being boxed in.

The Challenge

MCSAP supports some of Microsoft’s largest and most complex Azure customers, coordinating across internal teams whenever a customer experiences a critical issue. Its mandate is twofold:to mitigate critical incidents as quickly as possible and to complete the retrospective and problem management repairs that prevent recurrence.

Both halves of that mandate were, until recently, heavily manual. Understanding the business impact of a recurring issue meant relying on institutional memory rather than data. Tracking who was doing what across a large, fast-moving incident meant someone manually compiling updates. Handing an incident off between shifts meant one engineer spending significant time summarizing hours of context for the next. Finally, every mitigated incident still requires a root cause analysis (RCA) — a detailed account of what happened, why, and how it would be prevented — that Microsoft is contractually required to deliver within ten days.[3] Each one used to take an expert 60 to 120 minutes to write.[4] As demand grew, continuing with the same largely manual playbook would have added operational strain and slowed the team’s ability to respond consistently at enterprise scale.

The Solution

MCSAP built a multi-agent system called AED Intelligent Agent (AEDiA) on Microsoft Agent Framework that now underpins its entire incident and customer operations platform.

The first agent tackles business impact harvesting. Rather than rediscovering the impact of a recurring issue each time it resurfaces, the system now retains that history. A top U.S.-based airline once opened a case after an Azure Key Vault incident grounded flights — the cabin crew system depended on it. Establishing the full business impact took approximately five hours of coordination across the customer’s business and IT stakeholders before the dependency and its downstream effects were fully understood.[5] The next time a similar issue surfaced, MCSAP’s agents identified that dependency and business impact within minutes, letting the team pull in the right people immediately instead of re-learning the stakes from scratch.

A second set of agents handles the informational load of a live incident: curating a high-quality, minute-by-minute timeline of who engaged, what they found, and what they did, and generating handoff summaries so the next engineer coming onto shift can pick up an incident already underway without a lengthy verbal briefing. A related agent, drawing on how similar issues were resolved historically, proposes likely root causes while an incident is still active.

Once an incident is mitigated, an RCA agent takes over. Connected to Microsoft’s internal incident management platform and the rest of MCSAP’s data sources, it drafts a complete customer-facing RCA automatically, cutting a process that took an expert up to two hours down to seconds.

Across accounts, the same agents also look for patterns. When a large global asset manager experienced repeated virtual machine availability issues concentrated in one region, MCSAP used Microsoft Agent Framework to analyze the historical incident data, identify the common thread across the ticket history, and work with the responsible product group to fix the underlying issue, not just for that customer, but for every Azure customer on the affected infrastructure.

The Impact

The Time to Mitigate (TTM) for high-severity incidents has been reduced, accelerating incident resolution by more than 50%.[6] Customer-tailored RCAs that used to take 60 to 120 minutes of expert time now generate in seconds, including complex, multi-day incidents that previously demanded the most effort.[7] By autonomously resolving lower-severity incidents, MCSAP’s AI Autopilot reduces low-risk incident volume by up to 40%, cutting on-call burden and redirecting senior engineering expertise to mission-critical incidents.[8]Incident triage itself starts from a different place now. Gathering a customer’s history, business context, affected workloads, and prior incident knowledge used to take up to an hour of manual digging across systems; Microsoft Agent Framework now assembles that same context automatically within minutes, letting engineers spend their time on response instead of research.[9]

That speed doesn’t come at the cost of personal attention. A shared Prompt Store, a growing library of context-aware prompts with hundreds of users across teams[10], helps engineers draft responses that are still shaped around each customer’s specific situation and communication style, so every customer gets the same standard of thoughtful, tailored communication regardless of who happens to be on call that day. The result is an overall customer satisfaction score of 4.92 out of 5.[11]

That efficiency is compounding into capacity. MCSAP can now anticipate what a newly signed enterprise customer will require before that customer even goes live, turning growth from a source of operational strain into something the team can plan for with confidence. Faster resolution, consistent quality, and proactive capacity planning help the team scale support while maintaining a reliable customer experience.

“Microsoft Agent Framework, through AEDiA, is helping us redefine how Azure incident management operates at enterprise scale. By transforming years of engineering expertise into intelligent, always-available agents, we’re accelerating mitigation, improving operational consistency, and empowering engineers with real-time intelligence to focus on the most complex customer challenges. As Azure continues to grow, Agent Framework enables us to scale expertise, not just capacity, turning growth into an opportunity to deliver faster outcomes, greater operational foresight, and exceptional customer experiences.”

–Funmi Olowo, General Manager,  Engineering Operations

“This entire platform, from incident management to problem management, is built on Microsoft Agent Framework. It has helped us turn growth from an operational challenge into an opportunity to scale with confidence.”

–Fasiulla Mohammed, Principal Azure ACE Engineer, Azure Engineering Direct

Looking Ahead

MCSAP’s work on Microsoft Agent Framework is still evolving. The team is now exploring how to pair Microsoft Agent Framework with the GitHub Copilot SDK, offloading the harness for individual agents — memory compaction, file system and shell access — to Copilot SDK where it makes sense, while keeping orchestration and memory management on Microsoft Agent Framework.

The team’s ambitions extend well past its current footprint. MCSAP expects continued growth in strategic enterprise accounts, and Microsoft Agent Framework is central to supporting that growth without a comparable rise in headcount.

That same trajectory, from Microsoft Research experimentation to a production framework running some of Microsoft’s highest-stakes internal operations, is the throughline of Microsoft Agent Framework’s story. AutoGen and Semantic Kernel each proved half of what enterprises needed: research-grade orchestration and production-grade stability. Microsoft Agent Framework now delivers both, and teams like MCSAP are proving it can run at an enterprise scale. As more customers, inside Microsoft and out, build on top of it, that proof point keeps compounding. To explore and try more of our AI research, explore Foundry Labs – the home for cutting-edge AI experiments from Microsoft.

Sources and Citations

1. RCA generation time, reduced from up to two hours to seconds. Source: Microsoft internal operational telemetry, Azure Engineering Direct, FY26 (July 2025–June 2026).
2. Observed up to a 40% reduction in low-risk incident volume through autonomous resolution. Source: Microsoft internal operational data, Azure Engineering Direct.
3. Ten-day contractual commitment for delivery of customer-facing root cause analyses. Source: Microsoft service level objective for RCA delivery, Azure Engineering Direct.
4. Expert RCA authoring time of 60 to 120 minutes prior to automation. Source: Microsoft internal operational data, Azure Engineering Direct.
5. Approximately five hours to establish full business impact in the Azure Key Vault engagement described. Source: Microsoft internal incident records, Azure Engineering Direct; single customer engagement.
6. Time to Mitigate for high-severity incidents reduced approximately 50% on average. Source: Microsoft internal operational data, Azure Engineering Direct.
7. RCA generation time reduced to seconds. Source: Microsoft internal operational telemetry, Azure Engineering Direct, FY26 (July 2025–June 2026).
8. Observed up to a 40% reduction in low-risk incident volume through AI Autopilot autonomous resolution. Source: Microsoft internal operational data, Azure Engineering Direct.
9. Incident triage context-gathering reduced from up to one hour of manual effort to minutes on average. Source: Microsoft internal operational data, Azure Engineering Direct.
10. Prompt Store adoption of several hundred users across Azure Engineering Direct teams. Source: Microsoft internal platform usage data, Azure Engineering Direct.
11. Overall customer satisfaction score of 4.92 on a 5-point scale, measured across FY26 (July 2025–June 2026). Source: Microsoft internal customer satisfaction reporting, Azure Engineering Direct.