M365 Copilot — Work IQ

At a glance

What it is
The context layer that grounds M365 Copilot,
Cowork, and the built-in agents in your org's data.

The one boundary that matters
Inside first-party Copilot: included in the seat.
Through the Work IQ APIs: metered in Copilot Credits.

The API surface
Four domains (Chat, Context, Tools, Workspaces)
over three protocols (A2A, MCP, REST). GA June 16, 2026.

API domain	What it gives an agent	How it bills
Chat	The answer M365 Copilot would give, with citations, plus programmatic access to agents	Variable, per scenario
Context	The grounded content Copilot would use, already assembled in agent-ready form. No retrieval pipeline to build	Variable, per scenario
Tools	10 generic MCP tools that read and act on mail, calendar, files, people, chat, and sites	Static, 0.1 credits per call
Workspaces	Persistent SharePoint Embedded storage inside your tenant for long-running agent state. This is what Cowork and Scout run on	Part of task consumption

First, untangle the names. Microsoft ships four different "IQ" things

Name	What it actually is	Where you meet it
Work IQ	The always-on intelligence layer over your M365 work data, plus the APIs that expose it to agents. Since June 2026 it is also the name of the grounding toggle in Copilot Chat	This guide
Context IQ	The older name for the "/" reference picker that pins a specific file, person, or meeting to one prompt. Manual and per-prompt, where Work IQ is automatic and always-on. Microsoft's support doc now calls it the "references menu"	The @ References guide
Microsoft Graph	The raw data API underneath. Work IQ's entity tools resolve to Microsoft Graph v1.0 paths, then add the semantic layer, the policy engine, and Copilot's reasoning on top	Developer docs
Microsoft IQ	The Build 2026 umbrella brand: Work IQ (M365 work data) + Fabric IQ (structured business data via Microsoft Fabric) + Foundry IQ (agent knowledge via Azure AI Foundry) + Web IQ (live web grounding)	Copilot Studio's new agent experience

A note on Microsoft's own naming: Microsoft's docs currently describe Work IQ's internal layers two different ways ("Data, Memory, and Inference" in some pages, "data, context, and skills & tools" in others), and the API docs use a third cut: Chat, Context, Tools, Workspaces. The API-domain view is the one that maps to what you can actually call and what you pay for, so this guide uses it throughout.

What runs on Work IQ today

Copilot Chat & the apps

Work-data grounding in Copilot Chat (licensed users)
Drafting in Word, Excel, PowerPoint from your latest files and conversations
The Work IQ toggle: on by default, blends work and web grounding since June 22, 2026

Built-in agents

Researcher
Analyst
Facilitator
No incremental Work IQ charge under the Copilot licence

Long-running agents

Copilot Cowork (GA), grounded through Work IQ
Microsoft Scout (Frontier preview), the always-on "Autopilot" agent
Both persist task state in Work IQ Workspaces

Copilot Memory

Explicit memory: custom instructions + saved memories
Implicit memory: inferred from chat history
Available with and without a Copilot licence; still preview

New in June & July 2026

Reasoning over Power BI enterprise data (Frontier rollout, per Microsoft's June What's New roundup)
Planner plans + enterprise search added to the API's data list
Copilot Analytics insights on Cowork and Work IQ spend

What it is not

Not a product or SKU you can buy
Not the "/" reference picker (that is Context IQ)
Not callable app-only: every request runs as a signed-in user
Not a Graph replacement; it sits on top of Graph

The Work IQ APIs

Three protocols, one auth model, GA since June 16, 2026

Pick your protocol

Protocol	Endpoint	Built for	Worth knowing
A2A	`workiq.svc.cloud.microsoft/a2a/`	Agent-to-agent delegation from multi-agent systems	JSON-RPC over POST. Versions 1.0 and 0.3, selected with the `A2A-Version` header (no header = 0.3). Multi-turn via `contextId`
Remote MCP	`workiq.svc.cloud.microsoft/mcp`	Tool calling from agents, IDEs, and CLIs	One endpoint, 10 fixed tools. Clients discover auth via `/.well-known/oauth-protected-resource`
Local MCP (CLI)	`npx -y @microsoft/workiq mcp`	A stdio MCP server on your own machine	npm package v1.0.0. Requires `workiq accept-eula` first; preview versions are unsupported since GA
REST	`workiq.svc.cloud.microsoft/rest/conversations`	Multiturn conversations with M365 Copilot from services and orchestrators	Chat only: text responses, no actions, no long-running tasks. Continuation via `/chat` and `/chatOverStream`; a `/beta` channel exists but is unsupported for production

If you read "REST coming soon" anywhere, it is stale. All three protocols shipped in the June 16, 2026 GA wave: "A2A, a redesigned remote MCP server, and a REST API" per Microsoft's developer blog. The production REST endpoints are documented and live.

One auth model across everything

Microsoft Entra ID, delegated only. Every Work IQ request runs in the context of a signed-in user. On-behalf-of (OBO) flows are supported for server-side apps. Application-only authentication is not supported, on any protocol. That is a design decision, not a gap: Microsoft documents it as the mechanism that keeps an agent from ever seeing more than the human behind it.

The permission model is one delegated scope: WorkIQAgent.Ask (admin consent required), requested as api://workiq.svc.cloud.microsoft/WorkIQAgent.Ask. M365 permissions, sensitivity labels, and compliance policies are enforced automatically on every call.

Consequence for architects: unattended batch jobs and service-account automation have no path into Work IQ. If your design needs an agent acting under its own identity, that is the Agent 365 lane (agentic user identity), not the raw API.

Builder setup: 4 steps

Set up usage-based billing

A usage-based billing plan in Copilot Studio with an Azure subscription and resource group is the hard prerequisite. Assign the calling users to the plan. Without it, calls fail with a plain 403 (and newly assigned users need 15 to 30 minutes before it takes).

Create the Work IQ service principal

One-time Global Administrator action, about 5 minutes: az ad sp create --id fdcc1f02-fc51-4226-8753-f668596af7f7 (or the equivalent Graph POST to /v1.0/servicePrincipals).

Register an Entra app (confidential client + OBO for server-side), add the delegated WorkIQAgent.Ask permission, and grant admin consent. Token audience: api://workiq.svc.cloud.microsoft. Multitenant orgs: register as AzureADMultipleOrgs and sign users in through their home tenant.

Call a protocol

Official samples: github.com/microsoft/work-iq-samples (A2A in .NET, raw wire protocol included). The CLI and local MCP server live at github.com/microsoft/work-iq. Microsoft also hosts an interactive browser demo of the MCP ask tool at aka.ms/copilot.dev.

MCP in depth

10 tools, guardrails on by default, and one naming trap

The remote MCP server: 10 tools, fixed by design

Entity tools

fetch
create_entity
update_entity
delete_entity
do_action
call_function

Copilot tools

ask invokes M365 Copilot or a named agent, with multi-turn via conversationId
list_agents enumerates the agents you can address

Schema tools

get_schema returns JSON Schema or TypeScript definitions
search_paths discovers resource paths at runtime
Currently Microsoft Graph v1.0 only

How it works: tools are generic verbs; resource paths carry the meaning. fetch /me/messages reads mail, do_action /me/sendMail sends it. Microsoft's design note: "the tool surface stays fixed at 10." Paths grow; tools do not. That keeps agent tool-selection simple while the data surface expands.

Guardrails on by default

Reads are bounded, writes are off

Collection reads get a default $top of 25 (cap 100); chat messages cap at 10 per request; $skip is blocked. All mutations (create, update, delete, send) are disabled by default. Admins enable specific mutation scenarios via tenant policy; changes take up to 24 hours. Allowed path prefixes default to /me/, /users/, /sites/.

Policy over scopes

A Rego engine on every request

Instead of hundreds of static OAuth scopes, a Rego-based (Open Policy Agent) engine evaluates the path, method, user identity, and content of every request. Policy can deny; it can never grant beyond what the signed-in user already sees. Every tool invocation is logged. Admin surface: M365 admin center > Agents > Tools > Work IQ MCP > Policy.

The naming trap: "Work IQ MCP" is two different things right now

1. The remote Work IQ MCP server at workiq.svc.cloud.microsoft/mcp: one endpoint, the 10 generic tools above, GA, billed in Copilot Credits.

2. The per-workload "Work IQ MCP servers" delivered through the Agent 365 gateway at agent365.svc.cloud.microsoft/agents/tenants/{tenantId}/servers/mcp_*: a catalog of named servers (Work IQ Mail, Calendar, Teams, SharePoint, OneDrive, User, Word, Copilot) plus an MCP Management Server for building custom servers against 1,500+ connectors. These are preview, require a Microsoft 365 Copilot licence per user, and are the rebranded Agent 365 tooling servers. Admins allow or block them per tenant under Agents and Tools; a blocked server is blocked for every user and every agent, and tool-call traces are queryable in Microsoft Defender Advanced Hunting.

Vendor docs, community posts, and pricing pages routinely conflate the two. When you read a Work IQ MCP claim, first check which surface it is about.

Officially documented clients and maker surfaces

Client	Path in	Status
GitHub Copilot CLI	Dedicated quickstart against `workiq.svc.cloud.microsoft/mcp`, or the workiq plugin	Documented; CLI 1.0.40+ for the Agent 365 servers
Claude Code	`.mcp.json` against the Agent 365 per-workload servers, via an Entra enterprise app with per-server permissions (e.g. WorkIQ-MailServer)	Documented, preview, Copilot licence required
VS Code	`.vscode/mcp.json`, same Agent 365 pattern	Documented, preview; VS Code 1.118+
Copilot Studio	Tools > Add Tool > Model Context Protocol > pick a Work IQ server; or the "Microsoft IQ" sources toggle in the new agent experience	Preview. "GA is coming soon"; billing flips to consumption at that point
Microsoft Foundry	The `work_iq_preview` agent tool: A2A for Work IQ Chat, MCP endpoints for Teams, Word, Outlook, SharePoint, OneDrive	Preview, no SLA. OBO only, no VNet projects, Copilot licence per calling user

Microsoft documents exactly these clients. The config is standard HTTP MCP with Entra OAuth, so other MCP clients may work, but treat that as your own engineering risk, not a supported claim.

What it costs

The licence boundary, the rates, and the controls

The licence boundary, in Microsoft's own words

From the Copilot Credits Guide (July 2026 edition): "Microsoft 365 Copilot is natively built on Work IQ and does not need to leverage Work IQ APIs. There are no incremental charges for Work IQ accessed in Microsoft 365 Copilot experiences" such as chats, the Office apps, or the built-in agents (Researcher, Facilitator, Analyst). And the flip side: "Work IQ APIs are not included as entitlements in the Microsoft 365 Copilot license."

Translation: the June 2026 change is an additive metered layer for agents and API access. The base Copilot seat did not become metered and its price did not change. You pay Copilot Credits in exactly two situations: you build an agent or app that calls the Work IQ APIs, or a third-party agent grounds in your M365 data through them. There is no separate Work IQ subscription, SKU, or per-user licence. (The older Retrieval and Chat APIs stay free for Copilot-licensed users "for now", Microsoft's words.)

The rates Microsoft actually publishes

What	Meter	Rate
Work IQ inside first-party Copilot	None	No incremental charge under the Copilot licence
Work IQ Tools API	Static	0.1 Copilot Credits per API call (a tenth of a cent at PayGo rates)
Work IQ Chat / Context APIs	Variable	Scenario-based: grounding, retrieval, and reasoning. Microsoft publishes no numeric per-call rate; the illustrative credit ranges in the June edition of the Credits Guide were removed from the July edition
Cowork tasks	Variable	Four inputs: model use, context retrieval, tool calls, runtime. Microsoft's planning estimates: light 100 to 300 credits, medium 300 to 700, heavy above 700

Copilot Credits: three ways to buy, one consumption order

Pay-as-you-go

$0.01 per credit, billed in arrears through Azure via the Copilot Studio PayGo meter. The default on-ramp; no commitment.

Capacity packs

$200 per pack per month for 25,000 credits, sold as a tenant-wide Copilot Studio licence in the M365 admin center Marketplace. Replenish monthly, no rollover.

Pre-Purchase Plan (P3)

Annual, paid upfront, nine discount tiers from 300K credits (5%) to 300M (20%). Unused credits expire at term end; auto-renews; no cancel or exchange. MACC-eligible. Now self-serve from the M365 admin center too.

When several vehicles exist, consumption drains in a fixed order: capacity packs first, then P3 prepaid credits, then pay-as-you-go. Credits are pooled at the tenant level and shared across Cowork, Copilot Studio agents, Dynamics 365 agents, Power Platform AI, and the Work IQ APIs. For the full per-agent cost model, see the M365 Copilot agent cost and pricing reference.

The controls: set them before the first call, not after the first invoice

01
The Cost Management dashboard lives at M365 admin center > Copilot > Cost Management. It currently covers Cowork and the Work IQ API, with more services onboarding over time. Overview data refreshes every 4 hours, per-user/group/agent consumption every 2 hours.
02
Spending policies support an org-wide default plus group-scoped policies, a monthly credit limit per policy, optional per-user monthly caps, and email alerts from a chosen threshold (repeating weekly). Users who hit a hard cap lose agent access until the 1st of the month.
03
Watch one default: "Allow new services and agents as they become available" is ON by default in spending policies. New metered services inherit your billing unless you turn it off.
04
Budget the variable line like cloud spend. Fixed seats (base suite + $30 Copilot) plus a consumption line for agents, Cowork, and Work IQ grounding. The Tools API is predictable (0.1 credits per call); Chat and Context are not, so pilot small with caps before you scale.

The licence split to present carefully

Microsoft's docs state both of these, simultaneously and accurately: the GA Work IQ APIs are "independent of Microsoft 365 Copilot licensing" (anyone on a billing plan pays per use), while the preview surfaces (Copilot Studio's Work IQ, the Foundry tool, the Agent 365 MCP servers) each require a Microsoft 365 Copilot licence per calling user.

So today: raw API = consumption only. Managed maker surfaces = Copilot seat required, with Copilot Studio's own doc saying billing transitions to consumption when its Work IQ integration reaches GA. If you are budgeting a Copilot Studio agent on Work IQ, plan for that flip.

Cowork, Chat, and Memory

How the end-user surfaces sit on the same layer

The same layer, four different doors

Cowork

Work IQ is its grounding and its state

"Native Work IQ support grounds every task in the systems your business already runs on" (Microsoft's GA post). Task state persists in Work IQ Workspaces inside your tenant. Each task bills on four inputs: model use, context retrieval, tool calls, runtime. See the Cowork guide for the delegation playbook.

Copilot Chat, licensed

The Work IQ toggle replaced Work/Web

Since June 22, 2026 the app ships one Work IQ toggle, on by default, that blends enterprise data with web grounding in a single response (MC1325422). Off means web-only. The old two-position Work/Web toggle is gone; guides describing it are stale.

Copilot Chat, unlicensed

Web-grounded chat; tenant data via metered agents only

Without the Copilot licence, base chat grounds on the web. Tenant-grounded AI reaches unlicensed users only through agents billed on consumption (pay-as-you-go or capacity packs), not through base chat. Claims that free Chat gets Work IQ grounding conflate the two.

Copilot Memory

The personal end of the context layer

Explicit memory (custom instructions, saved memories) plus implicit memory inferred from chat history. Stored in a hidden folder in the user's Exchange mailbox; available with and without a Copilot licence; still preview. Purview retention does not apply to it. Details in the Memory guide.

Governance: what holds, and where the gap is

01
Security trimming is structural, not configured. Delegated auth only, every request user-scoped, and Microsoft documents that "no elevation of privilege is possible": agents see only what the signed-in user sees, with sensitivity labels and information barriers enforced automatically.
02
Writes are opt-in. Mutations are blocked by default across the MCP surface; an admin enables specific scenarios via tenant policy (Agents > Tools > Work IQ MCP > Policy). Initial release is tenant-level on/off only; no per-user or per-agent policies yet.
03
Data stays home during retrieval. Work IQ retrieval stays within the M365 tenant boundary and follows your tenant's data residency, not the calling project's region. Microsoft states customer content is not used to train models. One nuance from Microsoft's own Foundry page: routing a Foundry agent through Work IQ may send data outside the Azure compliance boundary; the M365 boundary and the Azure boundary are different things, and both statements sit on the same page.
04
The audit gap to know about: Purview covers agents at the Agent 365 agent-instance level (audit, eDiscovery, DLP, labels, with the nuance that encrypted content needs explicit VIEW and EXTRACT rights for the agent). But as of late July 2026 no Work IQ-specific audit record type is documented for raw API traffic. If your compliance story depends on auditing third-party Work IQ access, verify what actually lands in your logs before you attest to it.
05
Paper trail: use of the APIs is governed by dedicated Microsoft Work IQ APIs Terms of Use, and the CLI requires an explicit workiq accept-eula before first use.

Failure modes to expect

Empty results right after licence assignment. The Work IQ index takes 15 to 30 minutes to build after a Copilot licence lands on a user. Wait and retry before debugging anything else.

403 with no scope error. The user is not in a usage-based billing plan. Assign them and allow 15 to 30 minutes. A 403 that lists required scopes is a different failure: missing WorkIQAgent.Ask admin consent (as is AADSTS65001).

401 on a valid-looking token. Check the audience: it must be api://workiq.svc.cloud.microsoft.

400 AuthenticationError in multitenant orgs. The token issuer must match the signed-in user's home tenant. Register the app as AzureADMultipleOrgs and use the home-tenant authority.

Your unattended automation has no way in. There is no app-only auth, by design. If a workflow needs to run without a human signed in, Work IQ's raw APIs are the wrong tool; look at the Agent 365 agentic-identity lane instead.

REST answers, but will not act. The REST API is chat-only: text responses, no file creation, no sending, no long-running tasks. Actions go through the MCP tools, and mutations additionally need tenant policy enabled.

Preview churn breaks integrations. Microsoft's own warning: preview MCP tool names and parameters may change; avoid hard-coded dependencies. Community integration guides have gone stale within weeks. Early practitioners also report A2A responses commonly taking 10 to 30 seconds; design for that latency rather than assuming Graph-like response times.