Microsoft Azure SRE Agent Integration

Connect your Azure SRE Agent environment to Capsule Security for visibility into the agents that investigate and remediate your Azure infrastructure, along with the tools, skills, data connectors and MCP servers attached to them, and the conversations and approval decisions they produce.

Azure SRE Agent is a Microsoft preview product. Its resource provider and data plane APIs may change before general availability.

This integration uses Microsoft Entra ID (Azure AD) authentication to sync:

Capsule reads only. It never modifies agents, threads, or their configuration.

Before you begin, ensure you have:

• An active Azure subscription with at least one deployed SRE agent
• An Azure Entra ID account in your own tenant to run setup, with the permissions listed in Permissions for the account that runs setup
• Access to the Capsule Security portal

During the consent flow Capsule creates a custom Capsule SRE Agent Read-Only role and grants it to its own service principal on every subscription that holds an SRE agent. You do not pre-assign anything yourself. The role contains only read permissions (actions Microsoft.App/agents/read, Microsoft.App/agents/*/read; data action Microsoft.App/agents/*/read), so Capsule can read agents, tools, skills and threads but cannot change anything. It is granted at subscription scope so agents created after setup are covered without a second consent.

The account you sign in with is used both to discover agents and to assign Capsule its role, so it needs read and role assignment permissions:

User Access Administrator satisfies both requirements. Contributor does not: it can create and manage resources but cannot assign roles.

Microsoft shows its consent page every time you connect, even when your tenant has already granted Capsule access. If your tenant does not let users consent to applications, the account that runs setup must also be an Entra administrator who can grant consent.

After setup, you can remove the permissions that only setup needs. See Permissions and how to revoke them.

1. Log in to the Capsule Security portal

2. Click Integrations in the left sidebar

3. Find the Azure SRE Agent card and click Set up Integration

4. Review the Azure permissions the integration requests:

   Permission	Purpose
   Microsoft.App/agents/read	Discover SRE agents across your subscriptions
   Microsoft.App/agents/*/read	Read the tools, skills and data connectors attached to each agent
   Microsoft.App/agents/*/read (data action)	Read threads from each agent's endpoint
   Microsoft.Authorization/roleDefinitions/write	Create the read-only role
   Microsoft.Authorization/roleAssignments/write	Grant that role to Capsule on the discovered subscriptions

5. Click Connect

1. Sign in with the Azure account that has the permissions listed in Prerequisites

2. Review the permissions requested by the Capsule application

3. Click Accept to grant consent

Capsule uses your delegated token once, to complete setup:

1. Enumerates every enabled subscription your account can read
2. Lists Microsoft.App/agents in each subscription
3. Creates the Capsule SRE Agent Read-Only role and grants it to the Capsule service principal on each subscription that holds at least one agent
4. Creates one Capsule environment per such subscription

After setup, ongoing synchronization uses Capsule's own service principal credentials. Your delegated token is not stored.

SRE Agent conversations often identify people by display name only, so Capsule looks each person up in your directory through Microsoft Graph to attribute sessions to them. This needs the Microsoft Graph User.Read.All application permission, which setup does not grant yet. Without it, sessions still sync, but participants Capsule cannot identify from the conversation alone are left out.

Setup fails, rather than connecting, if no agents are discovered or if the role assignment succeeds nowhere. Without the role, every later sync would return 403.

Setup does succeed when the role lands on some subscriptions but not all. Capsule creates an environment for every subscription where it found agents, so a subscription whose assignment failed appears in Capsule but returns 403 on each sync and never populates. See Agents from one subscription never populate to recover it.

Scheduled tasks, hooks, incident filters and common prompts are intentionally not ingested. They are governance settings rather than attack surface.

Agents and their attached resources are read from Azure Resource Manager. Conversations are read from each agent's own data plane endpoint, which Capsule reaches per agent. Threads are fetched incrementally, so each sync picks up only what changed since the previous run.

After setup, verify that data is syncing correctly.

1. In Capsule, navigate to Inventory → Agents

2. Look for your SRE agents in the list

3. Click an agent to see its tools, skills, data connectors and MCP servers

1. Navigate to Observability

2. Filter Activity Type by Session

3. Open a session to view the thread

Initial sync begins automatically and may take several minutes depending on how many agents and threads you have.

After setup, Capsule reads your SRE Agent environment with its own service principal. This section lists what it holds in your tenant, what only setup used, and how to remove it.

The account that ran setup used its own Owner or User Access Administrator role once, to create and assign the Capsule role. That role belongs to that account, not to Capsule. If the account holds it only for setup, remove it afterwards, or use Microsoft Entra Privileged Identity Management to activate it only for setup and let it expire.

After setup, the only write-capable items Capsule holds are delegated grants, which it needs only at install time.

In short

• Keep: the Capsule SRE Agent Read-Only role assignment on each subscription that holds agents. Removing it stops every sync. Do not delete the role definition. Keep User.Read.All, if listed, for participant names on sessions.
• Safe to remove after setup: every delegated grant, the Microsoft Graph Application.Read.All application permission, and the built-in SRE Agent Reader assignment on older connections once Capsule SRE Agent Read-Only is assigned on the same subscription.
• Order: remove delegated grants, then application permissions, then role assignments. Check the integration in Capsule after each group.

A delegated grant lets Capsule act as the person who consented; Capsule uses it only during setup. An application permission lets Capsule act as itself, with no user signed in. An Azure role (RBAC) controls access to Azure resources.

Portal: In the Microsoft Entra admin center (entra.microsoft.com), open Entra ID → Enterprise apps → All applications and search for the Application (Client) ID that Capsule support provides, or the Capsule for SRE Agent name. Open the match. Its Object ID is the <SP_OBJECT_ID> used below.

CLI:

az ad sp show --id "<CAPSULE_APP_ID>" --query id -o tsv

The output is <SP_OBJECT_ID>.

The authorization request uses the /.default scope, so consent grants every delegated permission declared on Capsule's application at the time you consented, not only the ones Capsule uses. Capsule has since removed some of them, so older installs can hold more grants than new ones. Capsule uses its delegated token once during setup and does not store it, so all of them are safe to remove.

Portal: In the Microsoft Entra admin center, open the Capsule enterprise application, then Permissions → Admin consent (also check User consent). Select ... on a permission and choose Revoke permission. Revoking needs the Cloud Application Administrator or Application Administrator role. See Microsoft's guide. Grants given by individual users cannot be revoked in the portal; use the CLI.

CLI: List the grants. An empty list is possible; the Azure Resource Manager grant in particular may not exist.

az rest --method GET \
  --uri "https://graph.microsoft.com/v1.0/servicePrincipals/<SP_OBJECT_ID>/oauth2PermissionGrants" \
  --query "value[].{grantId:id, resourceId:resourceId, consentType:consentType, scope:scope}" -o table

resourceId is the service principal of the API the grant is for. To see its name:

az ad sp show --id "<RESOURCE_ID>" --query displayName -o tsv

Delete a grant by its grantId. This removes every scope in that grant. Grants made for the whole tenant show consentType AllPrincipals; a grant made for one user shows Principal. Delete both kinds.

az rest --method DELETE \
  --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/<GRANT_ID>"

Keep User.Read.All unless you accept that participants Capsule cannot identify from the conversation alone are left out of sessions (Session participants). Application.Read.All is safe to remove after install.

CLI: List the application permissions assigned to the Capsule service principal:

az rest --method GET \
  --uri "https://graph.microsoft.com/v1.0/servicePrincipals/<SP_OBJECT_ID>/appRoleAssignments" \
  --query "value[].{assignmentId:id, resourceId:resourceId, appRoleId:appRoleId}" -o table

To name a Microsoft Graph permission, look up its appRoleId:

az ad sp show --id 00000003-0000-0000-c000-000000000000 \
  --query "appRoles[?id=='<APP_ROLE_ID>'].value | [0]" -o tsv

Delete one using the listed resourceId as <RESOURCE_ID> (the API's service principal, not Capsule's) and the listed assignmentId as <ASSIGNMENT_ID>. This is the route Microsoft recommends:

az rest --method DELETE \
  --uri "https://graph.microsoft.com/v1.0/servicePrincipals/<RESOURCE_ID>/appRoleAssignedTo/<ASSIGNMENT_ID>"

Deleting through servicePrincipals/<SP_OBJECT_ID>/appRoleAssignments/<ASSIGNMENT_ID> also works but is not the recommended route. Deleting Microsoft Graph application permissions needs the Privileged Role Administrator role (Microsoft Learn).

Portal: The same Revoke permission action on the Admin consent tab may be available for application permissions; if you do not see it, use the CLI.

Removing an application permission does not invalidate tokens Capsule already holds. They stay valid until they expire: typically 60 to 90 minutes, and up to 28 hours for clients that support continuous access evaluation (Microsoft Learn).

Capsule needs the Capsule SRE Agent Read-Only assignment on every subscription with agents to sync. Remove the built-in SRE Agent Reader assignment only after you confirm in the list that Capsule SRE Agent Read-Only is assigned on the same subscription.

Portal: To see the role in the portal, open a subscription that holds SRE agents, go to Access control (IAM) → Role assignments and search for Capsule for SRE Agent. To see what the role allows, open the Roles tab and select Capsule SRE Agent Read-Only. The Capsule enterprise application's Permissions page in Entra lists API permissions only, so the role never appears there.

In the Azure portal, open the scope shown in the list (subscription, resource group, or resource), then Access control (IAM) → Role assignments. Tick the Capsule row, choose Remove, then Yes. An inherited row has to be removed at the parent scope; use its (Inherited) link. See Microsoft's guide.

CLI: List the assignments in each subscription. az role assignment list --all covers one subscription, so loop over the ones in your tenant:

for SUB in $(az account list --query "[?tenantId=='<TENANT_ID>'].id" -o tsv); do
  az role assignment list --subscription "$SUB" --assignee-object-id <SP_OBJECT_ID> --all \
    --query "[].{role:roleDefinitionName, scope:scope, assignmentId:id}" -o table
done

In the output, the built-in role is the row named SRE Agent Reader (role ID a4b156ac-253f-4a1a-9851-96d62b71b047).

Delete exactly one assignment by its assignmentId:

az role assignment delete --ids "<ASSIGNMENT_ID>"

Removing a role assignment needs Owner, User Access Administrator or Role Based Access Control Administrator on that scope. Assignments at management-group scope are not in this output; check them with --include-inherited or in the portal. Changes take up to about 10 minutes to propagate (Microsoft Learn).

To restore a removed Capsule SRE Agent Read-Only assignment, see Agents from one subscription never populate.

1. In Capsule, open Integrations and find the integration row

2. Open the row's actions menu and choose Sync. Wait about 10 minutes after removing a role assignment, and at least 90 minutes after removing an application permission, before you sync

3. Check the Status column. Failed means something you removed was needed; restore it with Restore a removed role

   Synced alone does not prove nothing broke: also check that agents still appear in Inventory → Agents and that new sessions still show participants

4. Check that Last synced moves to the current time

For what a healthy connection looks like, see Verification.

Reconnecting or reinstalling the integration re-runs consent with the /.default scope. Capsule asks Microsoft to show the consent screen every time, so accepting it re-creates every delegated grant declared on Capsule's application, including ones you removed. Reinstalling never grants application permissions, so any you remove stay removed. The grants it creates may be per-user rather than tenant-wide, so list them again. Reconnecting also re-creates the Capsule SRE Agent Read-Only role and its assignments. Repeat these steps after any reinstall.

The account that ran setup could not see any agents. Either the subscriptions holding your agents are not readable by that account, or no SRE agents are deployed. Confirm the agents are visible to that account in the Azure portal, then reconnect.

The account that ran setup cannot assign roles. Sign in with an account that has Owner or User Access Administrator on the relevant subscriptions and connect again.

The same message appears when Azure does not respond in time while Capsule creates its role. If the account already has one of those roles, select Try Again.

Agents are only discovered in subscriptions the account could read at setup time. Grant that account read access to the missing subscriptions and reconnect.

Azure currently restricts these collections in some tenants during preview. The agent, its model and its data connectors still sync. This resolves as the product moves toward general availability.

The role assignment succeeded on some subscriptions but not that one, which is enough for setup to complete. Either assign Capsule SRE Agent Read-Only to the Capsule for SRE Agent service principal on the affected subscription directly, or reconnect with an account that has Owner or User Access Administrator on it.

Connections created before Capsule switched from SRE Agent Reader to the Capsule SRE Agent Read-Only role must reconnect once, as Owner or User Access Administrator, so Capsule can create the role and grant it to the Capsule for SRE Agent service principal. Until then sync fails with a 403. The old Reader assignment can be removed.

Conversations are collected only from agents that are Running and expose an agent endpoint. A stopped agent still syncs its configuration, tools and connectors, but contributes no threads for as long as it stays stopped. Check the agent's power state first, then verify it has handled at least one thread and allow a sync cycle to complete.

Your tenant does not let users consent to applications, and Capsule asks for consent on every connection. Connect again with an Entra administrator account that also meets Permissions for the account that runs setup.

Restart the connection from the integrations page. A stale or reused callback link is rejected.

For help with this integration:

• Email: support@capsule.security
• Include: Your Microsoft tenant ID, the affected subscription IDs, integration status, and any error messages

For Azure SRE Agent issues:

• Azure SRE Agent Documentation: learn.microsoft.com/azure/sre-agent