{"id":58230,"date":"2026-08-03T12:02:06","date_gmt":"2026-08-03T02:02:06","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/"},"modified":"2026-08-03T12:03:29","modified_gmt":"2026-08-03T02:03:29","slug":"monitoring-ai-agent-activity-with-sentinel-and-opentelemetry","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/","title":{"rendered":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Monitoring AI Agent Activity with Sentinel and OpenTelemetry we will show how to spot risky actions, control unexpected costs and understand what your AI agents are doing before a small problem becomes a serious incident.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">Many businesses can tell you which AI agents they have deployed, but not what those agents did yesterday. An agent may search company files, call external services, create records or trigger another agent, yet its activity is often scattered across application logs that nobody routinely checks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OpenTelemetry provides a consistent way to record that activity. Microsoft Sentinel, Microsoft&#8217;s cloud-based security monitoring platform, then analyses the records alongside identity, device and cloud security information to find behaviour that needs attention.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What the technology does in plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">OpenTelemetry is an open standard for collecting traces, logs and measurements from applications. A trace is simply a timeline showing the steps taken to complete a task, such as which agent started the task, which AI model it called, which tools it used and where something failed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Sentinel brings security information into a central workspace and searches it for suspicious patterns. It can create an incident when a rule is triggered and use automated workflows, called playbooks, to notify the right people or begin a controlled response.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Together, these technologies answer questions that standard application monitoring often misses:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Which agent performed the action?<\/li>\n<li>Was it acting for an employee, another agent or an automated process?<\/li>\n<li>Which files, databases, tools or business systems did it access?<\/li>\n<li>Did its behaviour match the permissions and purpose it was given?<\/li>\n<li>How many AI model calls and tokens did the task consume?<\/li>\n<li>Did the agent fail safely when an action was denied?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you already collect agent telemetry, our guide to monitoring Claude Code and agent activity with OpenTelemetry explains the operational foundation. The next step is turning selected telemetry into useful security detections.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How the monitoring flow works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The first step is adding OpenTelemetry instrumentation to the agent application. Instrumentation means adding a small amount of configuration and code so the application records important events in a standard format.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Those records can be sent to Azure Monitor and Application Insights, which provide Microsoft&#8217;s application monitoring and troubleshooting tools. Microsoft now supports AI agent views based on OpenTelemetry&#8217;s generative AI conventions, including visibility into agent performance, tool calls, token use and errors.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Relevant security events are then made available in the Log Analytics workspace used by Microsoft Sentinel. For custom events, Azure Monitor&#8217;s Logs Ingestion API and data collection rules can place selected fields into a dedicated table, filter unnecessary information and mask sensitive values before storage.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A practical flow looks like this:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>The AI agent begins a task and creates a trace identifier.<\/li>\n<li>OpenTelemetry records model calls, tool use, outcomes, timing and token consumption.<\/li>\n<li>Azure Monitor receives the telemetry and stores the required records.<\/li>\n<li>Microsoft Sentinel compares agent activity with Microsoft Entra ID sign-ins, Defender alerts, Azure changes and other security data.<\/li>\n<li>A detection rule creates an incident when behaviour exceeds an agreed risk threshold.<\/li>\n<li>A playbook alerts the security team and can start a response with human approval.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Record business context, not just technical events<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A log stating that an application made an API request is rarely useful to a CIO. A record stating that the payroll assistant exported employee data after its normal workflow was changed is much more meaningful.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Every important agent event should therefore include enough context to support a business decision:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Agent identity and owner<\/strong> so someone is accountable for it.<\/li>\n<li><strong>Agent version<\/strong> so incidents can be connected to recent changes.<\/li>\n<li><strong>User or requesting system<\/strong> so delegated actions can be investigated.<\/li>\n<li><strong>Tool and data source<\/strong> so you know what the agent attempted to access.<\/li>\n<li><strong>Outcome<\/strong> such as successful, denied, failed or awaiting approval.<\/li>\n<li><strong>Risk classification<\/strong> based on the action&#8217;s business impact.<\/li>\n<li><strong>Trace identifier<\/strong> so the full chain can be reconstructed.<\/li>\n<li><strong>Token and cost data<\/strong> so waste and runaway loops are visible.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For agents that communicate with other agents, preserve the same trace identifier across the conversation. Our article on monitoring A2A agent communication in Azure covers this multi-agent tracing model in more detail.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A simple instrumentation example<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The following Python example is deliberately simplified. It creates a trace around a tool call and records security-relevant facts without storing the employee&#8217;s request or the tool&#8217;s full response.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>from opentelemetry import trace\n\ntracer = trace.get_tracer(&quot;finance-agent&quot;)\n\nwith tracer.start_as_current_span(&quot;agent.tool.execute&quot;) as span:\n span.set_attribute(&quot;gen_ai.agent.name&quot;, &quot;finance-assistant&quot;)\n span.set_attribute(&quot;gen_ai.agent.version&quot;, &quot;2.4.1&quot;)\n span.set_attribute(&quot;business.owner&quot;, &quot;finance-operations&quot;)\n span.set_attribute(&quot;business.tool.name&quot;, &quot;invoice-export&quot;)\n span.set_attribute(&quot;business.action&quot;, &quot;export&quot;)\n span.set_attribute(&quot;business.risk_level&quot;, &quot;high&quot;)\n span.set_attribute(&quot;enduser.id&quot;, &quot;user-1842&quot;)\n\n result = run_invoice_export()\n\n span.set_attribute(&quot;business.outcome&quot;, result.status)\n span.set_attribute(&quot;business.records_affected&quot;, result.count)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact fields should match your governance requirements. The important point is consistency: every agent should describe identities, tools, outcomes and risk in the same way.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Use Sentinel to detect behaviour that matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Sentinel uses Kusto Query Language, usually called KQL, to search log data. A detection can look for repeated denied actions, unusually large exports, unexpected tools, sudden token increases or high-risk activity from a newly deployed agent version.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, the following illustrative query looks for agents repeatedly attempting actions that were denied:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AgentActivity_CL\n| where TimeGenerated &amp;gt; ago(15m)\n| where Outcome_s == &quot;denied&quot;\n| summarize DeniedActions=count(),\n Tools=make_set(ToolName_s),\n TraceIds=make_set(TraceId_s)\n by AgentId_s, UserId_s, bin(TimeGenerated, 5m)\n| where DeniedActions &amp;gt;= 5<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A single denied action may show that a control worked. Five denials in a few minutes may indicate a broken workflow, an agent stuck in a retry loop or an attempt to work around its permissions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Useful Sentinel detections for most organisations include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An agent using a privileged tool it has never used before.<\/li>\n<li>A large increase in model calls or tokens compared with its normal workload.<\/li>\n<li>Repeated attempts to access restricted files or systems.<\/li>\n<li>A high-risk action without the required human approval.<\/li>\n<li>An agent identity signing in from an unexpected environment.<\/li>\n<li>A new agent version followed by increased failures or unusual exports.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Do not turn monitoring into a privacy problem<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Collecting every prompt and response may sound useful, but it can create unnecessary privacy, legal and security exposure. Agent conversations may contain customer details, employee information, commercial documents or credentials that should never have appeared in a prompt.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Application Insights can store generative AI content, including prompts, outputs, system instructions and tool interactions, in a dedicated table. Access to this sensitive content should be restricted separately, and organisations should avoid capturing it unless there is a clear and approved need.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Start with metadata such as agent identity, model, tool, outcome, timing, token count and risk level. Apply role-based access, suitable retention periods and data collection rules that remove fields you do not need.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A real-world business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person professional services company using an AI agent to prepare project reports. After an update, the agent begins retrying a failed document search hundreds of times and then calls a broader file-search tool.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Without joined-up monitoring, the first warning may be a larger Azure bill or a complaint that confidential files appeared in an unexpected report. With OpenTelemetry and Sentinel, the company can see the retry loop, connect it to the new version, identify the broader tool call and suspend the workflow before sensitive information leaves the approved process.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The outcome is not simply better logging. It is faster investigation, lower AI consumption costs and a defensible record showing what happened and how the business responded.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Start with one agent and three risks<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Do not begin by sending every available event into Sentinel. That approach increases storage costs and produces alerts your team will eventually ignore.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Choose one business-critical agent and identify its three most important risks. Instrument those actions, create a small number of meaningful detections and test the response process with the agent&#8217;s business owner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudPro Inc combines more than 20 years of enterprise IT experience with hands-on work across Microsoft Azure, Microsoft 365, OpenAI, Claude, Microsoft Defender and Wiz. As a Microsoft Partner and Wiz Security Integrator based in Melbourne, we help organisations build monitoring that supports real operational decisions rather than another dashboard nobody checks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are not sure whether your AI agents are creating blind spots, unexpected costs or compliance gaps, we are happy to review the current setup and identify the first practical monitoring steps \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Learn how Microsoft Sentinel and OpenTelemetry can reveal risky AI agent behaviour, control costs and give leaders a clear audit trail without collecting unnecessary sensitive data.<\/p>\n","protected":false},"author":1,"featured_media":58232,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_opengraph-title":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry","_yoast_wpseo_opengraph-description":"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.","_yoast_wpseo_twitter-title":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry","_yoast_wpseo_twitter-description":"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[80,121,21,13],"tags":[],"class_list":["post-58230","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-agents","category-ai-governance-risk-management","category-azure-monitor","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Monitoring AI Agent Activity with Sentinel and OpenTelemetry<\/title>\n<meta name=\"description\" content=\"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Monitoring AI Agent Activity with Sentinel and OpenTelemetry\" \/>\n<meta property=\"og:description\" content=\"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/\" \/>\n<meta property=\"og:site_name\" content=\"CPI Consulting\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-03T02:02:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-03T02:03:29+00:00\" \/>\n<meta name=\"author\" content=\"CPI Staff\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Monitoring AI Agent Activity with Sentinel and OpenTelemetry\" \/>\n<meta name=\"twitter:description\" content=\"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"CPI Staff\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/\"},\"author\":{\"name\":\"CPI Staff\",\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#\\\/schema\\\/person\\\/192eeeb0ce91062126ce3822ae88fe6e\"},\"headline\":\"Monitoring AI Agent Activity with Sentinel and OpenTelemetry\",\"datePublished\":\"2026-08-03T02:02:06+00:00\",\"dateModified\":\"2026-08-03T02:03:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/\"},\"wordCount\":1319,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/#primaryimage\"},\"thumbnailUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png\",\"articleSection\":[\"AI Agents\",\"AI Governance &amp; Risk Management\",\"Azure Monitor\",\"Blog\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/\",\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/\",\"name\":\"Monitoring AI Agent Activity with Sentinel and OpenTelemetry\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/#primaryimage\"},\"thumbnailUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png\",\"datePublished\":\"2026-08-03T02:02:06+00:00\",\"dateModified\":\"2026-08-03T02:03:29+00:00\",\"description\":\"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/#primaryimage\",\"url\":\"\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png\",\"contentUrl\":\"\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png\",\"width\":1536,\"height\":1024},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/2026\\\/08\\\/03\\\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cloudproinc.com.au\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Monitoring AI Agent Activity with Sentinel and OpenTelemetry\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#website\",\"url\":\"https:\\\/\\\/cloudproinc.com.au\\\/\",\"name\":\"Cloud Pro Inc - CPI Consulting Pty Ltd\",\"description\":\"Cloud, AI &amp; Cybersecurity Consulting | Melbourne\",\"publisher\":{\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cloudproinc.com.au\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#organization\",\"name\":\"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd\",\"url\":\"https:\\\/\\\/cloudproinc.com.au\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/favfinalfile.png\",\"contentUrl\":\"\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/favfinalfile.png\",\"width\":500,\"height\":500,\"caption\":\"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd\"},\"image\":{\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cloudproinc.com.au\\\/#\\\/schema\\\/person\\\/192eeeb0ce91062126ce3822ae88fe6e\",\"name\":\"CPI Staff\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g\",\"caption\":\"CPI Staff\"},\"sameAs\":[\"http:\\\/\\\/www.cloudproinc.com.au\"],\"url\":\"https:\\\/\\\/www.cloudproinc.com.au\\\/index.php\\\/author\\\/cpiadmin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry","description":"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/","og_locale":"en_US","og_type":"article","og_title":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry","og_description":"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.","og_url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/","og_site_name":"CPI Consulting","article_published_time":"2026-08-03T02:02:06+00:00","article_modified_time":"2026-08-03T02:03:29+00:00","author":"CPI Staff","twitter_card":"summary_large_image","twitter_title":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry","twitter_description":"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.","twitter_misc":{"Written by":"CPI Staff","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/#article","isPartOf":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/"},"author":{"name":"CPI Staff","@id":"https:\/\/cloudproinc.com.au\/#\/schema\/person\/192eeeb0ce91062126ce3822ae88fe6e"},"headline":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry","datePublished":"2026-08-03T02:02:06+00:00","dateModified":"2026-08-03T02:03:29+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/"},"wordCount":1319,"commentCount":0,"publisher":{"@id":"https:\/\/cloudproinc.com.au\/#organization"},"image":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png","articleSection":["AI Agents","AI Governance &amp; Risk Management","Azure Monitor","Blog"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/","url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/","name":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry","isPartOf":{"@id":"https:\/\/cloudproinc.com.au\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/#primaryimage"},"image":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/#primaryimage"},"thumbnailUrl":"\/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png","datePublished":"2026-08-03T02:02:06+00:00","dateModified":"2026-08-03T02:03:29+00:00","description":"Track AI agent activity to detect risky actions, control unexpected costs, trace tool use and build meaningful security alerts before incidents escalate.","breadcrumb":{"@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/#primaryimage","url":"\/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png","contentUrl":"\/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png","width":1536,"height":1024},{"@type":"BreadcrumbList","@id":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/03\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cloudproinc.com.au\/"},{"@type":"ListItem","position":2,"name":"Monitoring AI Agent Activity with Sentinel and OpenTelemetry"}]},{"@type":"WebSite","@id":"https:\/\/cloudproinc.com.au\/#website","url":"https:\/\/cloudproinc.com.au\/","name":"Cloud Pro Inc - CPI Consulting Pty Ltd","description":"Cloud, AI &amp; Cybersecurity Consulting | Melbourne","publisher":{"@id":"https:\/\/cloudproinc.com.au\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cloudproinc.com.au\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cloudproinc.com.au\/#organization","name":"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd","url":"https:\/\/cloudproinc.com.au\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cloudproinc.com.au\/#\/schema\/logo\/image\/","url":"\/wp-content\/uploads\/2022\/01\/favfinalfile.png","contentUrl":"\/wp-content\/uploads\/2022\/01\/favfinalfile.png","width":500,"height":500,"caption":"Cloud Pro Inc - Cloud Pro Inc - CPI Consulting Pty Ltd"},"image":{"@id":"https:\/\/cloudproinc.com.au\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/cloudproinc.com.au\/#\/schema\/person\/192eeeb0ce91062126ce3822ae88fe6e","name":"CPI Staff","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d96eeb53b791d92c8c50dd667e3beec92c93253bb6ff21c02cfa8ca73665c70?s=96&d=mm&r=g","caption":"CPI Staff"},"sameAs":["http:\/\/www.cloudproinc.com.au"],"url":"https:\/\/www.cloudproinc.com.au\/index.php\/author\/cpiadmin\/"}]}},"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/08\/monitoring-ai-agent-activity-with-sentinel-and-opentelemetry.png","jetpack-related-posts":[{"id":57880,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/16\/monitoring-claude-code-and-agent-activity-with-opentelemetry\/","url_meta":{"origin":58230,"position":0},"title":"Monitoring Claude Code and Agent Activity With OpenTelemetry","author":"CPI Staff","date":"July 16, 2026","format":false,"excerpt":"Claude Code can move fast, but leaders need visibility. Here is how OpenTelemetry helps monitor cost, risk, productivity, and agent behaviour without slowing teams down.","rel":"","context":"In &quot;AI Coding Agents&quot;","block_context":{"text":"AI Coding Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-coding-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 1x, \/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 1.5x, \/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 2x, \/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 3x, \/wp-content\/uploads\/2026\/07\/monitoring-claude-code-and-agent-activity-with-opentelemetry.png 4x"},"classes":[]},{"id":57949,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/21\/monitoring-and-troubleshooting-a2a-agent-communication-in-azure\/","url_meta":{"origin":58230,"position":1},"title":"Monitoring and Troubleshooting A2A Agent Communication in Azure","author":"CPI Staff","date":"July 21, 2026","format":false,"excerpt":"Learn how to trace A2A agent conversations in Azure, diagnose failures faster, control costs and give business leaders confidence that multi-agent workflows are operating safely.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/monitoring-and-troubleshooting-a2a-agent-communication-in-azure.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/monitoring-and-troubleshooting-a2a-agent-communication-in-azure.png 1x, \/wp-content\/uploads\/2026\/07\/monitoring-and-troubleshooting-a2a-agent-communication-in-azure.png 1.5x, \/wp-content\/uploads\/2026\/07\/monitoring-and-troubleshooting-a2a-agent-communication-in-azure.png 2x, \/wp-content\/uploads\/2026\/07\/monitoring-and-troubleshooting-a2a-agent-communication-in-azure.png 3x, \/wp-content\/uploads\/2026\/07\/monitoring-and-troubleshooting-a2a-agent-communication-in-azure.png 4x"},"classes":[]},{"id":58214,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/02\/why-ai-agents-need-separate-identities-permissions-and-audit-logs\/","url_meta":{"origin":58230,"position":2},"title":"Why AI Agents Need Separate Identities Permissions and Audit Logs","author":"CPI Staff","date":"August 2, 2026","format":false,"excerpt":"AI agents can access data and act at machine speed. Separate identities, limited permissions and reliable audit logs keep that power controlled, accountable and easier to govern.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/why-ai-agents-need-separate-identities-permissions-and-audit-logs.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/why-ai-agents-need-separate-identities-permissions-and-audit-logs.png 1x, \/wp-content\/uploads\/2026\/08\/why-ai-agents-need-separate-identities-permissions-and-audit-logs.png 1.5x, \/wp-content\/uploads\/2026\/08\/why-ai-agents-need-separate-identities-permissions-and-audit-logs.png 2x, \/wp-content\/uploads\/2026\/08\/why-ai-agents-need-separate-identities-permissions-and-audit-logs.png 3x, \/wp-content\/uploads\/2026\/08\/why-ai-agents-need-separate-identities-permissions-and-audit-logs.png 4x"},"classes":[]},{"id":57923,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/20\/building-production-ready-net-a2a-agents-on-azure-container-apps\/","url_meta":{"origin":58230,"position":3},"title":"Building Production-Ready .NET A2A Agents on Azure Container Apps","author":"CPI Staff","date":"July 20, 2026","format":false,"excerpt":"Learn how .NET, ASP.NET Core and Azure Container Apps turn A2A agents into secure, scalable business services with clear controls for cost, access and governance.","rel":"","context":"In &quot;.NET&quot;","block_context":{"text":".NET","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/net\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":58194,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/08\/01\/securing-ai-agent-identities-with-microsoft-entra-id-controls\/","url_meta":{"origin":58230,"position":4},"title":"Securing AI Agent Identities with Microsoft Entra ID Controls","author":"CPI Staff","date":"August 1, 2026","format":false,"excerpt":"AI agents can access business data and act at machine speed. Learn how Microsoft Entra ID gives each agent controlled access, clear ownership and an audit trail.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/securing-ai-agent-identities-with-microsoft-entra-id-controls.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/securing-ai-agent-identities-with-microsoft-entra-id-controls.png 1x, \/wp-content\/uploads\/2026\/08\/securing-ai-agent-identities-with-microsoft-entra-id-controls.png 1.5x, \/wp-content\/uploads\/2026\/08\/securing-ai-agent-identities-with-microsoft-entra-id-controls.png 2x, \/wp-content\/uploads\/2026\/08\/securing-ai-agent-identities-with-microsoft-entra-id-controls.png 3x, \/wp-content\/uploads\/2026\/08\/securing-ai-agent-identities-with-microsoft-entra-id-controls.png 4x"},"classes":[]},{"id":58133,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/07\/29\/how-to-limit-the-blast-radius-of-an-ai-agent-security-incident\/","url_meta":{"origin":58230,"position":5},"title":"How to Limit the Blast Radius of an AI Agent Security Incident","author":"CPI Staff","date":"July 29, 2026","format":false,"excerpt":"AI agents can turn one compromised instruction into a business-wide incident. Learn how to contain access, actions and data so mistakes stay small and recovery stays fast.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/how-to-limit-the-blast-radius-of-an-ai-agent-security-incident.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/how-to-limit-the-blast-radius-of-an-ai-agent-security-incident.png 1x, \/wp-content\/uploads\/2026\/07\/how-to-limit-the-blast-radius-of-an-ai-agent-security-incident.png 1.5x, \/wp-content\/uploads\/2026\/07\/how-to-limit-the-blast-radius-of-an-ai-agent-security-incident.png 2x, \/wp-content\/uploads\/2026\/07\/how-to-limit-the-blast-radius-of-an-ai-agent-security-incident.png 3x, \/wp-content\/uploads\/2026\/07\/how-to-limit-the-blast-radius-of-an-ai-agent-security-incident.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58230","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=58230"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58230\/revisions"}],"predecessor-version":[{"id":58231,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/58230\/revisions\/58231"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/58232"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=58230"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=58230"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=58230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}