# Microsoft Azure SRE Agent Integration

Connect your Azure SRE Agent environment to Capsule Security for visibility into the agents that investigate and remediate your Azure infrastructure, along with the tools, skills, subagents, data connectors and MCP servers attached to them, and the conversations and approval decisions they produce.

> Azure SRE Agent is a Microsoft preview product. Its resource provider and data plane APIs may change before general availability.


## Overview

This integration uses Microsoft Entra ID (Azure AD) authentication to sync:

| Category | What Gets Captured |
|  --- | --- |
| **Agents** | `Microsoft.App/agents` resources with configuration, power state, and default model |
| **Tools** | Tools attached to each agent |
| **Skills** | Skills attached to each agent |
| **Subagents** | Agents an SRE agent can delegate to |
| **Data Connectors** | The data sources an agent reads from, by connector type |
| **MCP Servers** | MCP servers referenced by an agent, and the agent to server connection |
| **Conversations** | Thread messages, captured as sessions |
| **Approvals** | Human-in-the-loop approval decisions |


Capsule reads only. It never modifies agents, threads, or their configuration.

## Prerequisites

Before you begin, ensure you have:

- An active **Azure subscription** with at least one deployed SRE agent
- An **Azure Entra ID** account in your own tenant to run setup, with the permissions listed in [Permissions for the account that runs setup](#permissions-for-the-account-that-runs-setup)
- Access to the **Capsule Security** portal


During the consent flow Capsule grants its own service principal the built-in **SRE Agent Reader** role on every subscription that holds an SRE agent. You do not pre-assign it yourself. The role is granted at subscription scope so agents created after setup are covered without a second consent.

### Permissions for the account that runs setup

The account you sign in with is used both to discover agents and to assign Capsule its role, so it needs read and role assignment permissions:

| Requirement | Why |
|  --- | --- |
| An account in your own Entra tenant | Discovery and role assignment are evaluated against your tenant and your subscriptions |
| **Owner** or **User Access Administrator** on every subscription holding SRE agents | Assigning the SRE Agent Reader role requires `Microsoft.Authorization/roleAssignments/write` |
| Read access to those same subscriptions | Agents in a subscription the account cannot read are not discovered |


**User Access Administrator** satisfies both requirements. **Contributor** does not: it can create and manage resources but cannot assign roles.

If your tenant requires admin approval for new applications, an Entra administrator consents to the Capsule application once before setup can complete.

## Step 1: Configure the Integration in Capsule

### Steps

1. Log in to the **Capsule Security** portal
2. Click **Integrations** in the left sidebar


1. Find the **Azure SRE Agent** card and click **Set up Integration**
2. Review the Azure permissions the integration requests:
| Permission | Purpose |
|  --- | --- |
| `Microsoft.App/agents/read` | Discover SRE agents across your subscriptions |
| `Microsoft.App/agents/*/read` | Read the tools, skills, subagents and data connectors attached to each agent |
| `Microsoft.Authorization/roleAssignments/write` | Grant Capsule the SRE Agent Reader role on the discovered subscriptions |
3. Click **Connect**


## Step 2: Authorize the Capsule Application

### Steps

1. Sign in with the Azure account that has the permissions listed in [Prerequisites](#prerequisites)
2. Review the permissions requested by the Capsule application


1. Click **Accept** to grant consent


### What happens during consent

Capsule uses your delegated token once, to complete setup:

1. Enumerates every enabled subscription your account can read
2. Lists `Microsoft.App/agents` in each subscription
3. Grants the Capsule service principal the **SRE Agent Reader** role on each subscription that holds at least one agent
4. Creates one Capsule environment per such subscription


After setup, ongoing synchronization uses Capsule's own service principal credentials. Your delegated token is not stored.

Setup fails, rather than connecting, if no agents are discovered or if the role assignment succeeds nowhere. Without the role, every later sync would return 403.

Setup does succeed when the role lands on some subscriptions but not all. Capsule creates an environment for every subscription where it found agents, so a subscription whose assignment failed appears in Capsule but returns 403 on each sync and never populates. See [Agents from one subscription never populate](#agents-from-one-subscription-never-populate) to recover it.

## What Gets Captured

| Entity Type | Category | Description |
|  --- | --- | --- |
| **SRE Agent** | Agent | Agent configuration, power state, action configuration, upgrade channel, and network settings |
| **Default Model** | Model Agent | The model backing the agent |
| **Tools** | Tool | Tools the agent can invoke |
| **Skills** | Skill | Skills attached to the agent |
| **Subagents** | Connected Agent | Agents the SRE agent can delegate to |
| **Data Connectors** | Data Source | Data sources the agent reads from, typed by connector type |
| **MCP Servers** | MCP Server | MCP servers the agent connects to |
| **Thread Messages** | Session | Conversation transcripts, keyed by thread |
| **Approval Decisions** | Session | Human-in-the-loop approvals, recorded as policy evaluations |


Scheduled tasks, hooks, incident filters and common prompts are intentionally not ingested. They are governance settings rather than attack surface.

### How the sync works

Agents and their attached resources are read from Azure Resource Manager. Conversations are read from each agent's own data plane endpoint, which Capsule reaches per agent. Threads are fetched incrementally, so each sync picks up only what changed since the previous run.

## Verification

After setup, verify that data is syncing correctly.

### Check agents

1. In Capsule, navigate to **Inventory → Agents**
2. Look for your SRE agents in the list
3. Click an agent to see its tools, skills, subagents, data connectors and MCP servers


### Check conversations

1. Navigate to **Observability**
2. Filter Activity Type by **Session**
3. Open a session to view the thread


Initial sync begins automatically and may take several minutes depending on how many agents and threads you have.

## Troubleshooting

### "No Azure SRE Agents found in the accessible subscriptions"

The account that ran setup could not see any agents. Either the subscriptions holding your agents are not readable by that account, or no SRE agents are deployed. Confirm the agents are visible to that account in the Azure portal, then reconnect.

### "Could not grant Capsule read access to the discovered subscriptions"

The account that ran setup cannot assign roles. Sign in with an account that has **Owner** or **User Access Administrator** on the relevant subscriptions and connect again.

### Some agents are missing

Agents are only discovered in subscriptions the account could read at setup time. Grant that account read access to the missing subscriptions and reconnect.

### Agents sync but their tools, skills or subagents are empty

Azure currently restricts these collections in some tenants during preview. The agent, its model and its data connectors still sync. This resolves as the product moves toward general availability.

### Agents from one subscription never populate

The role assignment succeeded on some subscriptions but not that one, which is enough for setup to complete. Either assign **SRE Agent Reader** to the Capsule service principal on the affected subscription directly, or reconnect with an account that has **Owner** or **User Access Administrator** on it.

### No conversations appearing

Conversations are collected only from agents that are **Running** and expose an agent endpoint. A stopped agent still syncs its configuration, tools and connectors, but contributes no threads for as long as it stays stopped. Check the agent's power state first, then verify it has handled at least one thread and allow a sync cycle to complete.

### Consent fails or the callback errors

Restart the connection from the integrations page. A stale or reused callback link is rejected.

## Support

For help with this integration:

- **Email**: support@capsule.security
- **Include**: Your Microsoft tenant ID, the affected subscription IDs, integration status, and any error messages


For Azure SRE Agent issues:

- **Azure SRE Agent Documentation**: [learn.microsoft.com/azure/sre-agent](https://learn.microsoft.com/en-us/azure/sre-agent/)