Asking Questions

Once your assistant is connected, ask in plain language. The assistant picks from 20 read-only tools, each answering one kind of question the way the matching StratoLens page does.

What You Can Ask

The tools are built for questions like these:

• "What changed since yesterday, and who did it?"
• "Who has Owner or User Access Administrator, and at what scope?"
• "Which role assignments are unused or over-privileged?"
• "Any critical security findings this week?" or "How many Defender alerts are open?"
• "Which policy assignments have the most non-compliant resources?"
• "What did we spend this month, by subscription?" or "Any cost anomalies?"
• "Where can we save money?" (sizing, orphaned resources, anomalies and commitment recommendations together)
• "Which reservations are underutilized or expiring soon?"
• "Which Azure retirements affect us in the next 90 days?"

Your Permissions and Scope

Every tool call runs as you, with your StratoLens roles and your data scope (all subscriptions, or the ones you are limited to). A personal view filter you set in the web app does not apply.

Each tool needs the same permission as the StratoLens page it matches (see the permission table). The assistant still sees all 20 tools; permission is checked on each call, and a call you lack the permission for fails with "Missing permission" and the permission's ID. Write or manage permissions you hold do nothing over MCP.

Answers Match the Pages

Tools apply the matching page's default view: the same time windows, thresholds and sort order, with hidden items left out. Counts therefore equal what the page shows with the same filters. Items an administrator hid on a page are counted separately, and the assistant can ask for them.

Two areas have more than one tool, and the difference matters:

• What changed. get_scan_changes compares two StratoLens scans exactly as the Changes page does: ignore rules applied, role-assignment changes included, with who made each change. The assistant is told to use it first. get_changes_summary and get_changes return raw Azure Resource Graph change events, useful for exactly when and by whom, but not filtered by ignore rules and without role-assignment changes. get_activity_log covers operations, including role assignment changes.
• Access. Each access tool uses its own page's role categories. Role Assignments treats any role containing "Owner" or "Administrator" as critical; Access Optimization treats only Owner and User Access Administrator as critical.

How Fresh the Answers Are

Inventory, access, security, policy, cost, savings and commitment answers come from StratoLens scans, and so do change events and the activity log, so every answer is as current as the latest scan. A change made after it shows up once the next scan runs.

Limits

Rate limit

Set by your administrator; default 60 tool calls per minute, per user and client. Over the limit, the message says how many seconds to wait.

Time

A tool call running longer than 60 seconds is stopped with a message to narrow the query.

Size

A result over 200 KB is refused with a message to narrow the query or lower limit.

Paging

Results come back in pages and the assistant pages through larger ones on its own. A broad resource search returns the first 50 matches, so ask a narrower question if you need more.

Time windows

At most 366 days on the change and activity-log tools.

Answers look wrong or a tool fails? See Troubleshooting.