ActionNex: A Virtual Outage Manager for Cloud Computing
Authors: Zhenfeng Lin, Haoji Hu, Ming Hao, Xuchao Zhang, Ryan Zhang, Junhao Li, Ze Li, Oleg Kulygin, Chetan Bansal, Hatay Tuna, Murali Chintalapati, Sheila Jiang, Salman Zafar, Angie Anderson
Organizations: Microsoft PRIMO, Redmond, USA · Microsoft Azure Core, Redmond, USA · Microsoft Azure CTO Office, Redmond, USA · Microsoft Research, Redmond, USA
Outage management in large-scale cloud operations remains heavily manual, requiring rapid triage, cross-team coordination, and experience-driven decisions under partial observability. We present ActionNex, a production-grade agentic system that supports end-to-end outage assistance, including real-time updates, knowledge distillation, and role- and stage-conditioned next-best action recommendations. ActionNex ingests multimodal operational signals (e.g., outage content, telemetry, and human communications) and compresses them into critical events that represent meaningful state transitions. It couples this perception layer with a hierarchical memory subsystem: long-term Key-Condition-Action (KCA) knowledge distilled from playbooks and historical executions, episodic memory of prior outages, and working memory of the live context. A reasoning agent aligns current critical events to preconditions, retrieves relevant memories, and generates actionable recommendations; executed human actions serve as an implicit feedback signal to enable continual self-evolution in a human-agent hybrid system. We evaluate ActionNex on eight real Azure outages (8M tokens, 4,000 critical events) using two complementary ground-truth action sets, achieving 71.4% precision and 52.8-54.8% recall. The system has been piloted in production and has received positive early feedback.
Figures & tables
Figure 1. ActionNex Framework
Memory
Source & Content
Role in Reasoning
Long-Term Memory (Knowledge Base)
Aggregated reference knowledge, including outage management manuals, SOPs, service playbooks , guidelines, and domain-specific expertise, indexed as Key–Condition–Action (KCA) triples.
Provides canonical solutions and best-practice actions for known scenarios when matching conditions are satisfied.
Episodic Memory (Case Library)
Logs of historical outages , including critical events, decisions taken, and outcomes (success or failure). Each case records the outage context (e.g., service, severity), the identified precondition, and the actions used for resolution.
Provides analogous examples from prior outages. Successful actions suggest viable strategies, while failed actions indicate approaches to avoid.
Working Memory (Current Context)
Live Outage state , including recently attempted actions, intermediate results, conversation history, and the current outage stage or status. This memory is continuously updated as the outage evolves.
Provides situational awareness , ensuring recommendations account for what has already occurred, thereby preventing redundant or contradictory actions and maintaining a coherent action sequence.
Table 1. Memory types used by the agent and their roles in outage reasoning and action recommendation.
Cloud-native systems have made operational work both more powerful and harder to automate: incidents unfold across microservices, logs and metrics arrive faster than operators can inspect them, and recovery actions must be coordinated without losing the causal context that makes them safe. We present AOI (AI-Oriented Operations), a context-aware multi-agent framework for autonomous IT operations. AOI separates operational responsibility across an Observer, a read-only Probe, and a guarded Executor, and connects them through dynamic scheduling and a hierarchical memory system with LLM-based context compression. This design turns long-running incident response into an iterative loop of observation, evidence gathering, safe intervention, and memory update. Across AIOpsLab simulations and real-world Loghub-derived scenarios, AOI improves task success to 94.2%, reduces mean time to resolution by 34.4% relative to the strongest baseline, and compresses operational context by 72.4% while preserving 92.8% of diagnostic information. Ablations show that these gains come from the combination of agent specialization, adaptive scheduling, and memory-aware compression rather than from any single module alone. The results suggest that autonomous operations systems can move beyond alert classification toward reliable, context-preserving recovery in complex infrastructure.
Zishan Bai, Hanxuan Chen, Jiayi Gu +9
Columbia University · Hunan University · Central University of Finance and Economics +8
Cloud network infrastructure at hyperscale presents unique operational challenges where traditional human-driven incident response cannot keep pace with the volume, velocity, and complexity of failures. This paper presents an agentic AI architecture for autonomous incident resolution in large-scale network operations. Our system employs a multi-agent orchestration framework where specialized AI agents collaborate to detect, diagnose, and remediate network incidents without human intervention. We describe the architectural principles, including hierarchical agent decomposition, skills-based tool invocation via standardized protocols, structured knowledge encoding from operational runbooks, progressive autonomy with safety boundaries, and closed-loop verification. The architecture has been deployed in production at a major cloud provider, demonstrating that agentic AI systems can achieve autonomous resolution rates exceeding 90% for common incident categories while maintaining safety guarantees through layered authorization and rollback mechanisms. We discuss design tradeoffs, failure modes, and lessons learned from operating autonomous AI agents at scale.
Large language model (LLM) agents offer a promising data-driven approach to automating Site Reliability Engineering (SRE), yet their enterprise deployment is constrained by three challenges: restricted access to proprietary data, unsafe action execution under permission-governed environments, and the inability of closed systems to improve from failures. We present AOI (Autonomous Operations Intelligence), a trainable multi-agent framework formulating automated operations as a structured trajectory learning problem under security constraints. Our approach integrates three key components. First, a trainable diagnostic system applies Group Relative Policy Optimization (GRPO) to distill expert-level knowledge into locally deployed open-source models, enabling preference-based learning without exposing sensitive data. Second, a read-write separated execution architecture decomposes operational trajectories into observation, reasoning, and action phases, allowing safe learning while preventing unauthorized state mutation. Third, a Failure Trajectory Closed-Loop Evolver mines unsuccessful trajectories and converts them into corrective supervision signals, enabling continual data augmentation. Evaluated on the AIOpsLab benchmark, our contributions yield cumulative gains. (1) The AOI runtime alone achieves 66.3% best@5 success on all 86 tasks, outperforming the prior state-of-the-art (41.9%) by 24.4 points. (2) Adding Observer GRPO training, a locally deployed 14B model reaches 42.9% avg@1 on 63 held-out tasks with unseen fault types, surpassing Claude Sonnet 4.5. (3) The Evolver converts 37 failed trajectories into diagnostic guidance, improving end-to-end avg@5 by 4.8 points while reducing variance by 35%.