Before you begin
- The ai.advisor.view permission to use Atlas Advisor, including its Recommendations tab. The built-in Administrator, Operator, Security Admin, Auditor and Helpdesk roles have it
- The ai.advisor.manage permission to change a recommendation's status, or dismiss or snooze it. Administrator, Operator and Security Admin have it
- Admin rights to connect an AI provider or change the AI settings
- To use AI answers: an API key from OpenAI, Anthropic or xAI, or an Azure OpenAI resource
The three tabs
- Investigate: the chat. Ask a question and follow up.
- Recommendations: the Environment briefing and the list of findings from the recommendation engines.
- Chat history: your saved conversations. Conversations are saved once an AI provider is connected.
Connect your AI provider
Until a provider is connected, the top-right corner of the Advisor page shows Connect an API key. Click it (after connecting, the same button shows the provider's name) to open Advisor AI settings. You can also connect a provider during first-run setup, on the Atlas Compass step's Connect your own AI card. If you skip that card, you can connect a provider here at any time.
- Turn on Turn on the AI assistant for this tenant.
- Under Answer engine, choose a provider. How to get a key opens that provider's key page and shows the recommended model and a rough monthly cost.
- Paste your API key. For Azure OpenAI, enter your resource endpoint and deployment name, or click Detect to choose a deployment.
- Optionally, pick a model. Leave it empty to use the provider's default. For Claude you can also set Reasoning effort.
- Click Test connection, then save.
- ChatGPT (OpenAI), Claude (Anthropic) and Grok (xAI) use an API key from your account with that provider.
- Azure OpenAI (Gov) uses your own Azure OpenAI resource in Azure Government and its key.
- Azure OpenAI (your tenant, no key) uses your own Azure OpenAI resource and signs in with the Atlas app's managed identity, so you don't need to store a key.
Your key is stored encrypted in your own Atlas AVD deployment and is never shown again after you save it. To replace it, enter a new one. Setting Answer engine back to Built-in (no API key) deletes the saved provider, key and model.
GCC High: Azure OpenAI in Azure Government only
On a GCC High deployment or tenant, Advisor answers only through Azure OpenAI in Azure Government: Azure OpenAI (Gov), or Azure OpenAI (your tenant, no key), which uses the Azure Government endpoint on a GCC High deployment. ChatGPT, Claude and Grok are not offered there, because they would send data outside the Government boundary. A request that would cross the boundary is refused before anything is sent.
The one exception is a deployment configured with an attestation that it holds no CUI. Without that attestation, commercial providers stay blocked.
What it costs: Usage & budget
Atlas adds no AI charge. What Advisor uses is billed to your own provider account at that provider's prices. The Usage & budget section of Advisor AI settings shows the tokens used this month and an estimated cost. Your provider's bill is the authoritative figure.
- Monthly token budget: caps the tokens Advisor may use each month.
- Monthly spend budget (USD): caps the estimated monthly spend.
- 0 means unlimited. Once usage reaches a cap, AI answers pause for the tenant until the next month or until you raise the cap. Both caps are checked before any request goes to the provider, so nothing more is spent.
Without a key: the built-in engine
When no provider is connected, Advisor answers with its built-in engine and shows Answering with the built-in engine. It recognises a fixed set of question types, such as active and disconnected sessions, unhealthy hosts, pending reboots and cost, and answers them from live data. Each question stands alone, with no follow-ups. Nothing is sent to any AI provider. Recommendations, root-cause analysis and the Environment briefing all work without a key.
If your provider fails or stops being configured, that answer falls back to the built-in engine and Advisor tells you so.
Investigate: ask in plain language
On the Investigate tab, ask anything about your environment, from "How many users are logged in?" to "Why was login slow yesterday?" or "Where am I wasting money?". Advisor looks up the data it needs with read-only tools, writes an answer, and attaches the supporting table so you can sort and export it. Follow-up questions carry the recent conversation.
- Tool trace: expand it on an answer to see each lookup Advisor ran and how many rows it returned.
- Scope to a host pool: open Advisor with Ask Atlas Advisor on a host pool's page, and every question in that session is limited to that pool. The pool shows at the top of the page, and you can clear it with one click.
- Ask from anywhere: press Ctrl+J (Cmd+J on a Mac) or click Ask Advisor in the header on any page, or use Explain this on a chart, alert, recommendation or failed job. Advisor opens with your question filled in and knows what you were looking at. You review the question before you send it.
- Attach files: add up to four log files, pasted text or screenshots to a question. They are sent only for that question and are not saved.
Advisor only reads data the person asking is allowed to see. A tool that needs a permission you don't have is not offered at all.
Advisor is read-only: your team makes the change
Advisor reads your environment and never changes it. It answers, recommends the fix and can draft the steps or a script for you to copy, and someone on your team makes the change in Atlas AVD. That change goes through the same permissions and the same activity log as any other.
- Needs attention now: the Environment briefing (on the Recommendations tab) lists what to look at first. Each item's Ask Advisor button opens Investigate, where you can ask what to do about it.
- Advisor does not run changes or act on its own, from the chat, the briefing or Atlas Reach.
Ask Advisor from Atlas Reach
On an Atlas Reach device's page, choose Ask Advisor. Advisor opens on the Investigate tab with a request to diagnose that device and recommend fixes. Without an AI provider, the built-in engine runs a device triage and lists its findings. When a finding has a recommended fix, you carry it out yourself from the device page in Atlas Reach, for example by running a script or restarting the device.
Recommendations
The Recommendations tab opens with the Environment briefing: session hosts, active sessions, unhealthy hosts, critical alerts, month-to-date spend, potential savings, open recommendations and changes in the last 24 hours, plus what needs attention now. Below it is the recommendations list. The tab's badge counts new recommendations.
- Six engines produce findings: Cost Optimization, Performance, Capacity Planning, Security, Compliance and User Experience. You can filter the list by category, state and priority, or search it.
- Each recommendation is scored on impact × confidence × urgency. The score sets its priority: Critical, High, Medium, Low or Informational. Where it applies, it shows estimated monthly savings and its evidence.
- Use the thumbs up or thumbs down to tell Atlas whether a recommendation was helpful.
Recommendation lifecycle
A new recommendation starts as New. Use the Status menu to move it through its lifecycle, so your team can see who is handling what.
- Acknowledged: someone has reviewed it.
- In Progress: the team is working on it.
- Resolved: the change is done.
- Dismiss: hides the recommendation for everyone in the tenant, with an optional reason, until someone restores it.
- Snooze: hides it for a set number of days, after which it comes back.
Anyone with ai.advisor.view can read recommendations. Changing the status, dismissing, snoozing and rating need ai.advisor.manage, so a read-only role can't hide a cost or security finding for the whole tenant.
Privacy: what leaves your tenant
Atlas does not host or proxy an AI model and receives none of your Advisor traffic. Requests go straight from your Atlas AVD deployment, in your Azure subscription, to the provider you chose. With the built-in engine, nothing leaves your deployment at all.
- What a question sends: your question, a short window of the recent conversation, any files you attached, and the results of the read-only tools Advisor ran: telemetry such as host pools, sessions, costs, health and alerts, and host names.
- What is never sent: Azure credentials, Atlas secrets, API keys, and any data the person asking isn't allowed to see.
- Where it goes: to OpenAI, Anthropic or xAI under your own account terms with them, or to your own Azure OpenAI resource, which keeps it inside your tenant. The Azure OpenAI options carry a Stays in your tenant badge in the settings.
In Advisor AI settings → Data sent to your provider, an admin can turn off Allow user identities (names and sign-in addresses are replaced with pseudonyms, and user-lookup tools are hidden), Allow directory data (Entra ID users, groups and Conditional Access), and Allow device evidence (live device diagnostics). These settings only change what is sent to the provider, not what you see on screen. Read the data-boundary statement link there for the full details.