{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Microsoft Azure SRE Agent Integration","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"microsoft-azure-sre-agent-integration","__idx":0},"children":["Microsoft Azure SRE Agent Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connect your Azure SRE Agent environment to Capsule Security for visibility into the agents that investigate and remediate your Azure infrastructure, along with the tools, skills, data connectors and MCP servers attached to them, and the conversations and approval decisions they produce."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure SRE Agent is a Microsoft preview product. Its resource provider and data plane APIs may change before general availability."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This integration uses Microsoft Entra ID (Azure AD) authentication to sync:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Category"},"children":["Category"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What Gets Captured"},"children":["What Gets Captured"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agents"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents"]}," resources with configuration, power state, and default model"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tools"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tools attached to each agent"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Skills"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Skills attached to each agent"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data Connectors"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The data sources an agent reads from, by connector type"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MCP Servers"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MCP servers referenced by an agent, and the agent to server connection"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Conversations"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Thread messages, captured as sessions"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approvals"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Human-in-the-loop approval decisions"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule reads only. It never modifies agents, threads, or their configuration."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, ensure you have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An active ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Azure subscription"]}," with at least one deployed SRE agent"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Azure Entra ID"]}," account in your own tenant to run setup, with the permissions listed in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#permissions-for-the-account-that-runs-setup"},"children":["Permissions for the account that runs setup"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," portal"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["During the consent flow Capsule creates a custom ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule SRE Agent Read-Only"]}," role and grants it to its own service principal on every subscription that holds an SRE agent. You do not pre-assign anything yourself. The role contains only read permissions (actions ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/*/read"]},"; data action ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/*/read"]},"), so Capsule can read agents, tools, skills and threads but cannot change anything. It is granted at subscription scope so agents created after setup are covered without a second consent."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"permissions-for-the-account-that-runs-setup","__idx":3},"children":["Permissions for the account that runs setup"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The account you sign in with is used both to discover agents and to assign Capsule its role, so it needs read and role assignment permissions:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Requirement"},"children":["Requirement"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Why"},"children":["Why"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An account in your own Entra tenant"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Discovery and role assignment are evaluated against your tenant and your subscriptions"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Owner"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User Access Administrator"]}," on every subscription holding SRE agents"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Creating and assigning the custom role requires ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.Authorization/roleDefinitions/write"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.Authorization/roleAssignments/write"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read access to those same subscriptions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agents in a subscription the account cannot read are not discovered"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User Access Administrator"]}," satisfies both requirements. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Contributor"]}," does not: it can create and manage resources but cannot assign roles."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Microsoft shows its consent page every time you connect, even when your tenant has already granted Capsule access. If your tenant does not let users consent to applications, the account that runs setup must also be an Entra administrator who can grant consent."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After setup, you can remove the permissions that only setup needs. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#permissions-and-how-to-revoke-them"},"children":["Permissions and how to revoke them"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-configure-the-integration-in-capsule","__idx":4},"children":["Step 1: Configure the Integration in Capsule"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"steps","__idx":5},"children":["Steps"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Log in to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," portal"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Integrations"]}," in the left sidebar"]}]}]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":3},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Find the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Azure SRE Agent"]}," card and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up Integration"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Review the Azure permissions the integration requests:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Permission"},"children":["Permission"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/read"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Discover SRE agents across your subscriptions"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/*/read"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read the tools, skills and data connectors attached to each agent"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/*/read"]}," (data action)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read threads from each agent's endpoint"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.Authorization/roleDefinitions/write"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create the read-only role"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.Authorization/roleAssignments/write"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Grant that role to Capsule on the discovered subscriptions"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connect"]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-authorize-the-capsule-application","__idx":6},"children":["Step 2: Authorize the Capsule Application"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"steps-1","__idx":7},"children":["Steps"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sign in with the Azure account that has the permissions listed in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#prerequisites"},"children":["Prerequisites"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Review the permissions requested by the Capsule application"]}]}]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":3},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Accept"]}," to grant consent"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-happens-during-consent","__idx":8},"children":["What happens during consent"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule uses your delegated token once, to complete setup:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enumerates every enabled subscription your account can read"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Lists ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents"]}," in each subscription"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Creates the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule SRE Agent Read-Only"]}," role and grants it to the Capsule service principal on each subscription that holds at least one agent"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Creates one Capsule environment per such subscription"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After setup, ongoing synchronization uses Capsule's own service principal credentials. Your delegated token is not stored."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"session-participants","__idx":9},"children":["Session participants"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["SRE Agent conversations often identify people by display name only, so Capsule looks each person up in your directory through Microsoft Graph to attribute sessions to them. This needs the Microsoft Graph ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User.Read.All"]}," application permission, which setup does not grant yet. Without it, sessions still sync, but participants Capsule cannot identify from the conversation alone are left out."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Setup fails, rather than connecting, if no agents are discovered or if the role assignment succeeds nowhere. Without the role, every later sync would return 403."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Setup does succeed when the role lands on some subscriptions but not all. Capsule creates an environment for every subscription where it found agents, so a subscription whose assignment failed appears in Capsule but returns 403 on each sync and never populates. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#agents-from-one-subscription-never-populate"},"children":["Agents from one subscription never populate"]}," to recover it."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-gets-captured","__idx":10},"children":["What Gets Captured"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Entity Type"},"children":["Entity Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Category"},"children":["Category"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SRE Agent"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agent"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Agent configuration, power state, action configuration, upgrade channel, and network settings"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Default Model"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Model Agent"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The model backing the agent"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tools"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tool"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tools the agent can invoke"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Skills"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Skill"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Skills attached to the agent"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data Connectors"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Data Source"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Data sources the agent reads from, typed by connector type"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MCP Servers"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MCP Server"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["MCP servers the agent connects to"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Thread Messages"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Session"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Conversation transcripts, keyed by thread"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Approval Decisions"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Session"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Human-in-the-loop approvals, recorded as policy evaluations"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Scheduled tasks, hooks, incident filters and common prompts are intentionally not ingested. They are governance settings rather than attack surface."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"how-the-sync-works","__idx":11},"children":["How the sync works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Agents and their attached resources are read from Azure Resource Manager. Conversations are read from each agent's own data plane endpoint, which Capsule reaches per agent. Threads are fetched incrementally, so each sync picks up only what changed since the previous run."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"verification","__idx":12},"children":["Verification"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After setup, verify that data is syncing correctly."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"check-agents","__idx":13},"children":["Check agents"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In Capsule, navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inventory → Agents"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Look for your SRE agents in the list"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click an agent to see its tools, skills, data connectors and MCP servers"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"check-conversations","__idx":14},"children":["Check conversations"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Observability"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Filter Activity Type by ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Session"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Open a session to view the thread"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Initial sync begins automatically and may take several minutes depending on how many agents and threads you have."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"permissions-and-how-to-revoke-them","__idx":15},"children":["Permissions and how to revoke them"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After setup, Capsule reads your SRE Agent environment with its own service principal. This section lists what it holds in your tenant, what only setup used, and how to remove it."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The account that ran setup used its own Owner or User Access Administrator role once, to create and assign the Capsule role. That role belongs to that account, not to Capsule. If the account holds it only for setup, remove it afterwards, or use Microsoft Entra Privileged Identity Management to activate it only for setup and let it expire."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After setup, the only write-capable items Capsule holds are delegated grants, which it needs only at install time."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["In short"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Keep:"]}," the Capsule SRE Agent Read-Only role assignment on each subscription that holds agents. Removing it stops every sync. Do not delete the role definition. Keep ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User.Read.All"]},", if listed, for participant names on sessions."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Safe to remove after setup:"]}," every delegated grant, the Microsoft Graph ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Application.Read.All"]}," application permission, and the built-in SRE Agent Reader assignment on older connections once Capsule SRE Agent Read-Only is assigned on the same subscription."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Order:"]}," remove delegated grants, then application permissions, then role assignments. Check the integration in Capsule after each group."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-capsule-holds","__idx":16},"children":["What Capsule holds"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A delegated grant lets Capsule act as the person who consented; Capsule uses it only during setup. An application permission lets Capsule act as itself, with no user signed in. An Azure role (RBAC) controls access to Azure resources."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Permission"},"children":["Permission"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Kind"},"children":["Kind"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Scope"},"children":["Scope"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Access"},"children":["Access"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"When Capsule uses it"},"children":["When Capsule uses it"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"If you remove it"},"children":["If you remove it"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Azure Resource Manager ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["user_impersonation"]}," (if listed)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entra delegated grant"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All users in your tenant, or only the user who consented"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Write-capable (acts as the signed-in user); Capsule used it once, to discover agents and to create the role and assignment"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Install time"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Nothing. Reinstalling shows the consent screen again and re-creates it"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Azure SRE Agent ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Threads.ReadWrite.All"]}," (older installs only)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entra delegated grant"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All users in your tenant, or only the user who consented"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read and write (per its name)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Install time"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Nothing after install"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Microsoft Graph ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["openid"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["profile"]}," (if listed)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entra delegated grant"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All users in your tenant, or only the user who consented"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Sign-in only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Install time"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Nothing"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Microsoft Graph ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User.Read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Application.Read.All"]}," (older installs only)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entra delegated grant"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All users in your tenant, or only the user who consented"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Install time"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Nothing"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Microsoft Graph ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User.Read.All"]}," (only if listed, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#session-participants"},"children":["Session participants"]},")"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entra application permission"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tenant"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ongoing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Participants Capsule cannot identify from the conversation alone are left out of sessions. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#session-participants"},"children":["Session participants"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Microsoft Graph ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Application.Read.All"]}," (only if listed)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Entra application permission"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Tenant"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Install time"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Nothing after install"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Capsule SRE Agent Read-Only"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Azure RBAC role (custom)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Each subscription that holds an agent"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read (actions ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/*/read"]},"; data action ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/*/read"]},")"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ongoing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Every sync returns 403. Agents, tools, skills and conversations stop"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Capsule SRE Agent Read-Only role definition"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Azure RBAC role definition"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Subscriptions where setup found agents"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read-only content"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ongoing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Do not delete it. A role definition cannot be deleted while it has assignments, and removing the integration is out of scope here"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["SRE Agent Reader (built-in)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Azure RBAC role"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Subscription"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.Authorization/*/read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.App/agents/read"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Microsoft.Insights/alertRules/read"]},"; thread, graph, memory and incident data reads)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Ongoing"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Older connections only. Nothing, once Capsule SRE Agent Read-Only is assigned on the same subscription. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#existing-connections"},"children":["Existing connections"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"find-the-capsule-service-principal","__idx":17},"children":["Find the Capsule service principal"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Portal:"]}," In the Microsoft Entra admin center (entra.microsoft.com), open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Entra ID → Enterprise apps → All applications"]}," and search for the Application (Client) ID that Capsule support provides, or the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule for SRE Agent"]}," name. Open the match. Its ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Object ID"]}," is the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["<SP_OBJECT_ID>"]}," used below."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["CLI:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az ad sp show --id \"<CAPSULE_APP_ID>\" --query id -o tsv\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The output is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["<SP_OBJECT_ID>"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"remove-delegated-grants","__idx":18},"children":["Remove delegated grants"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The authorization request uses the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/.default"]}," scope, so consent grants every delegated permission declared on Capsule's application at the time you consented, not only the ones Capsule uses. Capsule has since removed some of them, so older installs can hold more grants than new ones. Capsule uses its delegated token once during setup and does not store it, so all of them are safe to remove."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Portal:"]}," In the Microsoft Entra admin center, open the Capsule enterprise application, then ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Permissions → Admin consent"]}," (also check ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User consent"]},"). Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["..."]}," on a permission and choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Revoke permission"]},". Revoking needs the Cloud Application Administrator or Application Administrator role. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions"},"children":["Microsoft's guide"]},". Grants given by individual users cannot be revoked in the portal; use the CLI."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["CLI:"]}," List the grants. An empty list is possible; the Azure Resource Manager grant in particular may not exist."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az rest --method GET \\\n  --uri \"https://graph.microsoft.com/v1.0/servicePrincipals/<SP_OBJECT_ID>/oauth2PermissionGrants\" \\\n  --query \"value[].{grantId:id, resourceId:resourceId, consentType:consentType, scope:scope}\" -o table\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resourceId"]}," is the service principal of the API the grant is for. To see its name:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az ad sp show --id \"<RESOURCE_ID>\" --query displayName -o tsv\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Delete a grant by its ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["grantId"]},". This removes every scope in that grant. Grants made for the whole tenant show ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["consentType"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["AllPrincipals"]},"; a grant made for one user shows ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Principal"]},". Delete both kinds."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az rest --method DELETE \\\n  --uri \"https://graph.microsoft.com/v1.0/oauth2PermissionGrants/<GRANT_ID>\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"remove-application-permissions","__idx":19},"children":["Remove application permissions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keep ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["User.Read.All"]}," unless you accept that participants Capsule cannot identify from the conversation alone are left out of sessions (",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#session-participants"},"children":["Session participants"]},"). ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Application.Read.All"]}," is safe to remove after install."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["CLI:"]}," List the application permissions assigned to the Capsule service principal:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az rest --method GET \\\n  --uri \"https://graph.microsoft.com/v1.0/servicePrincipals/<SP_OBJECT_ID>/appRoleAssignments\" \\\n  --query \"value[].{assignmentId:id, resourceId:resourceId, appRoleId:appRoleId}\" -o table\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To name a Microsoft Graph permission, look up its ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["appRoleId"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az ad sp show --id 00000003-0000-0000-c000-000000000000 \\\n  --query \"appRoles[?id=='<APP_ROLE_ID>'].value | [0]\" -o tsv\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Delete one using the listed ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resourceId"]}," as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["<RESOURCE_ID>"]}," (the API's service principal, not Capsule's) and the listed ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["assignmentId"]}," as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["<ASSIGNMENT_ID>"]},". This is the route Microsoft recommends:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az rest --method DELETE \\\n  --uri \"https://graph.microsoft.com/v1.0/servicePrincipals/<RESOURCE_ID>/appRoleAssignedTo/<ASSIGNMENT_ID>\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Deleting through ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["servicePrincipals/<SP_OBJECT_ID>/appRoleAssignments/<ASSIGNMENT_ID>"]}," also works but is not the recommended route. Deleting Microsoft Graph application permissions needs the Privileged Role Administrator role (",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://learn.microsoft.com/en-us/graph/api/serviceprincipal-delete-approleassignedto"},"children":["Microsoft Learn"]},")."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Portal:"]}," The same ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Revoke permission"]}," action on the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Admin consent"]}," tab may be available for application permissions; if you do not see it, use the CLI."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Removing an application permission does not invalidate tokens Capsule already holds. They stay valid until they expire: typically 60 to 90 minutes, and up to 28 hours for clients that support continuous access evaluation (",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens"},"children":["Microsoft Learn"]},")."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"remove-azure-role-assignments","__idx":20},"children":["Remove Azure role assignments"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule needs the Capsule SRE Agent Read-Only assignment on every subscription with agents to sync. Remove the built-in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SRE Agent Reader"]}," assignment only after you confirm in the list that Capsule SRE Agent Read-Only is assigned on the same subscription."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Portal:"]}," To see the role in the portal, open a subscription that holds SRE agents, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access control (IAM) → Role assignments"]}," and search for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule for SRE Agent"]},". To see what the role allows, open the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Roles"]}," tab and select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule SRE Agent Read-Only"]},". The Capsule enterprise application's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Permissions"]}," page in Entra lists API permissions only, so the role never appears there."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the Azure portal, open the scope shown in the list (subscription, resource group, or resource), then ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access control (IAM) → Role assignments"]},". Tick the Capsule row, choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Remove"]},", then ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Yes"]},". An inherited row has to be removed at the parent scope; use its ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["(Inherited)"]}," link. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-remove"},"children":["Microsoft's guide"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["CLI:"]}," List the assignments in each subscription. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["az role assignment list --all"]}," covers one subscription, so loop over the ones in your tenant:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"for SUB in $(az account list --query \"[?tenantId=='<TENANT_ID>'].id\" -o tsv); do\n  az role assignment list --subscription \"$SUB\" --assignee-object-id <SP_OBJECT_ID> --all \\\n    --query \"[].{role:roleDefinitionName, scope:scope, assignmentId:id}\" -o table\ndone\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the output, the built-in role is the row named ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SRE Agent Reader"]}," (role ID ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["a4b156ac-253f-4a1a-9851-96d62b71b047"]},")."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Delete exactly one assignment by its ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["assignmentId"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"az role assignment delete --ids \"<ASSIGNMENT_ID>\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Removing a role assignment needs ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Owner"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User Access Administrator"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Role Based Access Control Administrator"]}," on that scope. Assignments at management-group scope are not in this output; check them with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["--include-inherited"]}," or in the portal. Changes take up to about 10 minutes to propagate (",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting"},"children":["Microsoft Learn"]},")."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"restore-a-removed-role","__idx":21},"children":["Restore a removed role"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To restore a removed Capsule SRE Agent Read-Only assignment, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#agents-from-one-subscription-never-populate"},"children":["Agents from one subscription never populate"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"check-the-integration-in-capsule","__idx":22},"children":["Check the integration in Capsule"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In Capsule, open ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Integrations"]}," and find the integration row"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Open the row's actions menu and choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Sync"]},". Wait about 10 minutes after removing a role assignment, and at least 90 minutes after removing an application permission, before you sync"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Status"]}," column. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Failed"]}," means something you removed was needed; restore it with ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#restore-a-removed-role"},"children":["Restore a removed role"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Synced"]}," alone does not prove nothing broke: also check that agents still appear in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inventory → Agents"]}," and that new sessions still show participants"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check that ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Last synced"]}," moves to the current time"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For what a healthy connection looks like, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#verification"},"children":["Verification"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"reinstalling-adds-them-back","__idx":23},"children":["Reinstalling adds them back"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Reconnecting or reinstalling the integration re-runs consent with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/.default"]}," scope. Capsule asks Microsoft to show the consent screen every time, so accepting it re-creates every delegated grant declared on Capsule's application, including ones you removed. Reinstalling never grants application permissions, so any you remove stay removed. The grants it creates may be per-user rather than tenant-wide, so list them again. Reconnecting also re-creates the Capsule SRE Agent Read-Only role and its assignments. Repeat these steps after any reinstall."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":24},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"no-azure-sre-agents-found-in-the-accessible-subscriptions","__idx":25},"children":["\"No Azure SRE Agents found in the accessible subscriptions\""]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The account that ran setup could not see any agents. Either the subscriptions holding your agents are not readable by that account, or no SRE agents are deployed. Confirm the agents are visible to that account in the Azure portal, then reconnect."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"could-not-grant-capsule-read-access-to-the-discovered-subscriptions","__idx":26},"children":["\"Could not grant Capsule read access to the discovered subscriptions\""]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The account that ran setup cannot assign roles. Sign in with an account that has ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Owner"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User Access Administrator"]}," on the relevant subscriptions and connect again."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The same message appears when Azure does not respond in time while Capsule creates its role. If the account already has one of those roles, select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Try Again"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"some-agents-are-missing","__idx":27},"children":["Some agents are missing"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Agents are only discovered in subscriptions the account could read at setup time. Grant that account read access to the missing subscriptions and reconnect."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"agents-sync-but-their-tools-or-skills-are-empty","__idx":28},"children":["Agents sync but their tools or skills are empty"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Azure currently restricts these collections in some tenants during preview. The agent, its model and its data connectors still sync. This resolves as the product moves toward general availability."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"agents-from-one-subscription-never-populate","__idx":29},"children":["Agents from one subscription never populate"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The role assignment succeeded on some subscriptions but not that one, which is enough for setup to complete. Either assign ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule SRE Agent Read-Only"]}," to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule for SRE Agent"]}," service principal on the affected subscription directly, or reconnect with an account that has ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Owner"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User Access Administrator"]}," on it."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"existing-connections","__idx":30},"children":["Existing connections"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connections created before Capsule switched from SRE Agent Reader to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule SRE Agent Read-Only"]}," role must reconnect once, as ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Owner"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User Access Administrator"]},", so Capsule can create the role and grant it to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule for SRE Agent"]}," service principal. Until then sync fails with a 403. The old Reader assignment can be removed."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"no-conversations-appearing","__idx":31},"children":["No conversations appearing"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Conversations are collected only from agents that are ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Running"]}," and expose an agent endpoint. A stopped agent still syncs its configuration, tools and connectors, but contributes no threads for as long as it stays stopped. Check the agent's power state first, then verify it has handled at least one thread and allow a sync cycle to complete."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"microsoft-says-admin-approval-is-required","__idx":32},"children":["Microsoft says admin approval is required"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your tenant does not let users consent to applications, and Capsule asks for consent on every connection. Connect again with an Entra administrator account that also meets ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#permissions-for-the-account-that-runs-setup"},"children":["Permissions for the account that runs setup"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"consent-fails-or-the-callback-errors","__idx":33},"children":["Consent fails or the callback errors"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Restart the connection from the integrations page. A stale or reused callback link is rejected."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":34},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Email"]},": support@capsule.security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Include"]},": Your Microsoft tenant ID, the affected subscription IDs, integration status, and any error messages"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For Azure SRE Agent issues:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Azure SRE Agent Documentation"]},": ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://learn.microsoft.com/en-us/azure/sre-agent/"},"children":["learn.microsoft.com/azure/sre-agent"]}]}]}]},"headings":[{"value":"Microsoft Azure SRE Agent Integration","id":"microsoft-azure-sre-agent-integration","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Permissions for the account that runs setup","id":"permissions-for-the-account-that-runs-setup","depth":3},{"value":"Step 1: Configure the Integration in Capsule","id":"step-1-configure-the-integration-in-capsule","depth":2},{"value":"Steps","id":"steps","depth":3},{"value":"Step 2: Authorize the Capsule Application","id":"step-2-authorize-the-capsule-application","depth":2},{"value":"Steps","id":"steps-1","depth":3},{"value":"What happens during consent","id":"what-happens-during-consent","depth":3},{"value":"Session participants","id":"session-participants","depth":3},{"value":"What Gets Captured","id":"what-gets-captured","depth":2},{"value":"How the sync works","id":"how-the-sync-works","depth":3},{"value":"Verification","id":"verification","depth":2},{"value":"Check agents","id":"check-agents","depth":3},{"value":"Check conversations","id":"check-conversations","depth":3},{"value":"Permissions and how to revoke them","id":"permissions-and-how-to-revoke-them","depth":2},{"value":"What Capsule holds","id":"what-capsule-holds","depth":3},{"value":"Find the Capsule service principal","id":"find-the-capsule-service-principal","depth":3},{"value":"Remove delegated grants","id":"remove-delegated-grants","depth":3},{"value":"Remove application permissions","id":"remove-application-permissions","depth":3},{"value":"Remove Azure role assignments","id":"remove-azure-role-assignments","depth":3},{"value":"Restore a removed role","id":"restore-a-removed-role","depth":4},{"value":"Check the integration in Capsule","id":"check-the-integration-in-capsule","depth":3},{"value":"Reinstalling adds them back","id":"reinstalling-adds-them-back","depth":3},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"\"No Azure SRE Agents found in the accessible subscriptions\"","id":"no-azure-sre-agents-found-in-the-accessible-subscriptions","depth":3},{"value":"\"Could not grant Capsule read access to the discovered subscriptions\"","id":"could-not-grant-capsule-read-access-to-the-discovered-subscriptions","depth":3},{"value":"Some agents are missing","id":"some-agents-are-missing","depth":3},{"value":"Agents sync but their tools or skills are empty","id":"agents-sync-but-their-tools-or-skills-are-empty","depth":3},{"value":"Agents from one subscription never populate","id":"agents-from-one-subscription-never-populate","depth":3},{"value":"Existing connections","id":"existing-connections","depth":3},{"value":"No conversations appearing","id":"no-conversations-appearing","depth":3},{"value":"Microsoft says admin approval is required","id":"microsoft-says-admin-approval-is-required","depth":3},{"value":"Consent fails or the callback errors","id":"consent-fails-or-the-callback-errors","depth":3},{"value":"Support","id":"support","depth":2}],"frontmatter":{"seo":{"title":"Microsoft Azure SRE Agent Integration"}},"lastModified":"2026-10-18T07:52:16.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/azure-sre-agent","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}