Copilot in Azure: Control VMs in Natural Language

Copilot in Azure: VM management goes natural language

Microsoft Copilot in Azure integrates directly into the Azure portal and allows you to query or control resources by formulating requests in plain language. In a recent demonstration, Principal Cloud Advocates Rick Claus and Sonia Cuff (Microsoft) illustrate this functionality on a concrete case: checking the status of a virtual machine (VM), stopping it, then restarting it, without using the classic portal or writing a single line of script.

The benefit is not limited to convenience. For an operations team or level 1 help desk, the promise is to reduce the time to resolve common incidents while maintaining strict control over what the assistant is authorized to do.

What the demonstration shows

The scenario follows a simple flow, representative of a support intervention:

• querying the status of a VM ("is this machine started or stopped?");
• requesting the resource to be stopped via a natural language formulation;
• requesting a restart once the intervention is complete.

At each step, Copilot in Azure translates the request into an exploitable technical query, executes it within the portal context, then returns a readable result. The stated objective of the speakers is to show that this type of assistant can be entrusted to a help desk without degrading operational security.

RBAC: Copilot never acts beyond user permissions

The central technical point of the demonstration concerns permissions. Copilot in Azure executes an action only within the limits of the rights granted to the user who makes the request, via the role-based access control (RBAC) model already in place on the subscription or resource group.

In concrete terms:

• a user without the Virtual Machine Contributor role (or equivalent) on the resource will not be able to get Copilot to start or stop a VM;
• the assistant bypasses no existing Azure role assignment;
• administrators retain control over who can request Copilot for administrative actions, relying on standard Azure roles rather than a dedicated permissions layer.

This mechanism is crucial for considering delegation to a level 1 help desk: the assistant inherits the RBAC scope of the logged-in person, it does not expand its rights.

Confirmation before destructive action and transparency of requests

Two additional safeguards emerge from the demonstration:

• explicit confirmation before any action deemed destructive (stopping or restarting a VM, for example): the user validates the intent before execution, which limits the risk of action triggered by ambiguous wording;
• display of the underlying request generated by Copilot to respond to the natural language request. The user thus sees the technical logic translated from their question, which facilitates audit and understanding of the result obtained.

This transparency on the generated request is a key point for teams that must justify an action in a regulated environment or trace an intervention in an incident ticket.

Enabling Copilot in Azure: disabled by default in preview

Another technical point to remember: Copilot in Azure is disabled by default in its current preview state. Activation is an explicit decision at the tenant or subscription level, which gives administrators time to set up RBAC roles before any rollout to teams.

For practical implementation, the logic remains the same as for any Azure preview feature:

• enable the feature at the appropriate level (tenant or subscription);
• clearly define which RBAC roles will be exposed to the assistant;
• test on a non-critical environment before any rollout to a production help desk.

The official Microsoft Learn documentation on Copilot in Azure details the current prerequisites and functional scope of the assistant.

Use cases for operations and support teams

The most relevant scenarios for this type of assistant remain repetitive, low-risk tasks:

• quick verification of resource status before escalation;
• restarting a VM following a standard user request;
• first level of diagnostics without opening a ticket to the infrastructure team.

For more sensitive operations — network configuration changes, resource deletion, sizing changes — teams have every interest in maintaining existing workflows (Azure CLI, Azure PowerShell, Azure Automation) rather than relying on natural language interaction still in preview.

Key takeaways

• Copilot in Azure allows you to query and control VMs (checking, stopping, restarting) in natural language directly from the Azure portal.
• The assistant respects existing RBAC: it never acts beyond the permissions of the user making the request.
• Explicit confirmation is required before any destructive action, and the generated technical request remains visible to the user.
• The feature is disabled by default and remains in preview: its activation and RBAC scope must be planned before any rollout to a help desk.
• The most solid use cases today remain checks and common actions on VMs, not yet critical infrastructure operations.

Before any rollout to a support team, it is still recommended to audit existing Azure role assignments and test the assistant on a non-production subscription.