Microsoft IQ in Preview fails intermittently, has limited Auth

Kunal Bhargava (ZS Associates Inc) 0 Reputation points Microsoft External Staff
2026-07-13T10:16:15.41+00:00

Background: We're building/hosting multi-agent workflows

We're hoping to get support on two items, for Microsoft IQ preview:

1. FabricIQ Fails Intermittently - We're using the inbuilt tools on foundry that are in preview and have successful connections established to Semantic Models. But this setup seems to have limited reproducibility - the same connection that works may fail at another time. Is there a way to guardrail this today? Or an ETA on when this could be resolved?

2. WorkIQ Domain Issue - When using Work IQ (outlook & teams both), we're facing an MCP server error that declares the official agent365 MCP server domain as invalid. Is this expected? (error image attached: image.png)

3. Auth Capabilties - FabricIQ today only seems to support OAuth (alias level auth). While we're trying to use hosted agents that rely on their own agent runtime identity, with FabricIQ within the host. What would be the best way to enable this?

Thanks in advance!

Foundry Tools
Foundry Tools

Formerly known as Azure AI Services or Azure Cognitive Services is a unified collection of prebuilt AI capabilities within the Microsoft Foundry platform

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Karnam Venkata Rajeswari 5,255 Reputation points Microsoft External Staff Moderator
    2026-08-11T18:48:33.23+00:00

    Hello @Kunal Bhargava (ZS Associates Inc) ,

    For Fabric IQ, Work IQ, Outlook IQ, and Teams IQ GA Availability

    There is currently no publicly announced or committed General Availability (GA) date for Fabric IQ, Work IQ, Outlook-related Work IQ capabilities, Teams-related Work IQ capabilities, or the corresponding Foundry integrations. The current documentation continues to identify Fabric IQ and Work IQ as Preview features. Preview capabilities may evolve in functionality, authentication flows and service behavior before GA release.

    For Outlook / Teams IQ Endpoint Validation Error

    The reported error involving agent365.svc.cloud.microsoft need not automatically be interpreted as evidence that the domain itself is invalid.

    The current Work IQ documentation references the Agent 365 endpoint family and documents integration through Agent-to-Agent (A2A), MCP, and Toolbox-based scenarios. The documentation also shows Work IQ services operating through the agent365.svc.cloud.microsoft domain family.

    Based on the available evidence, the error is more likely occurring during one of the following stages:

    • Endpoint validation
    • Connection configuration validation
    • OAuth consent validation
    • Token audience validation
    • Licensing validation
    • Tenant policy validation
    • Preview feature enablement validation
    • MCP registration or initialization

    Recommended diagnostics:

    1. Capture the complete endpoint URL being configured.
    2. Capture the full error message.
    3. Collect UTC timestamp, Correlation ID, and Request ID.
    4. Validate OAuth configuration:
      • Client ID
      • Client Secret
      • Authorization URL
      • Token URL
      • Redirect URI
      • Scope configuration
    5. Confirm required admin consent has been granted.
    6. Confirm applicable billing, licensing, and connector prerequisites.
    7. Test the same capability through a Foundry Toolbox implementation.
    8. Inspect the MCP response for:
      • CONSENT_REQUIRED
      • -32006
      • Other MCP error codes

    A particularly valuable isolation test is to compare:

    • Direct endpoint behavior
    • Toolbox-based behavior

    f Toolbox succeeds while the direct endpoint path fails, that would strongly suggest the issue resides in endpoint validation or connection processing rather than the domain itself.

    Regarding Authentication Architecture for Hosted Agent + MAF + Fabric IQ

    For the described scenario:

    • Multiple Foundry prompt agents
    • MAF GroupChat orchestration
    • Workflow wrapped as a MAF agent
    • Deployment as a Foundry Hosted Agent
    • One or more agents consuming Fabric IQ

    the authentication challenge is that Hosted Agents have their own runtime identity while Fabric IQ commonly relies on delegated user context.

    For an interactive user-driven workflow, the recommended architecture to evaluate first is whne using user-entra-token

    End User >Foundry Hosted Agent >MAF / GroupChat >Foundry Toolbox >Fabric IQ > Fabric

    This configuration forwards the caller identity while keeping the Hosted Agent runtime identity separate. The delegated user identity is then used for Fabric authorization and permission enforcement.

    Recommended implementation steps:

    1. Create a Toolbox containing the Fabric IQ tool.
    2. Publish the Toolbox and obtain its MCP endpoint.
    3. Create a remote-tool connection using:
    4. Attach the Toolbox to the Hosted Agent as an MCP tool.
    5. Validate access using both authorized and unauthorized users to confirm permission enforcement.
    6. Ensure the required Foundry roles are assigned to:
      • Developer identity
      • Hosted Agent runtime identity
      • Delegated user identities

    For a unattended workflow where no user identity exists, a separate architecture can be evaluated using a published Fabric Data Agent exposed through its MCP endpoint. Fabric Data Agent MCP documentation supports bearer-token authentication and can be consumed directly by MCP clients. This should be viewed as a separate architecture rather than a replacement for delegated Fabric IQ access.

    For Fabric IQ ExecuteQuery Intermittent Failure

    The minimal query: EVALUATE ROW("ping", 1)

    The trace demonstrates that:

    • Tool discovery succeeds.
    • MCP communication succeeds.
    • Query execution is attempted.
    • ExecuteQuery subsequently fails.

    The most valuable next validation step is to execute the identical DAX query directly against the Power BI Execute Queries API using the same semantic model and identity.

    Recommended validation:

    1. Execute the same DAX query through the Execute Queries API.
    2. Record:
      • HTTP status
        • Response body
          • Correlation identifiers
          1. Confirm:
            • Dataset Read permission
              • Dataset Build permission
                • Dataset Execute Queries tenant setting
                1. Compare direct API behavior with Fabric IQ behavior.
                2. Perform retries across separate time windows rather than immediate repeated requests.

    If direct API execution consistently succeeds while Fabric IQ continues to fail, that would provide stronger evidence that the failure is isolated to the Fabric IQ integration path rather than the underlying semantic model service.

    The following references might be helpful , please check them out

    Please let us know if the response was helpful

     

    Thank you

    Was this answer helpful?

  2. Christos Panagiotidis 3,551 Reputation points
    2026-07-14T09:42:20.8666667+00:00

    Hi, I would separate these into three tracked issues. For intermittent Fabric IQ calls, add retry with exponential backoff and correlation logging, but do not treat a Preview dependency as having a production SLA. For the Work IQ MCP domain rejection, capture the exact endpoint, validation error, region, and request ID and raise it with the preview team—it may be an allow-list/configuration issue, not your agent. For authentication, if the connector currently exposes only delegated OAuth, a hosted agent's managed identity cannot be substituted unless that workload-identity flow is explicitly supported. Use a controlled middle-tier or delegated user flow for now, and confirm the preview roadmap/supportability before committing this architecture to production.

    Was this answer helpful?

    0 comments
  3. Karnam Venkata Rajeswari 5,255 Reputation points Microsoft External Staff Moderator
    2026-07-13T10:21:10.7333333+00:00

    Hello @Kunal Bhargava (ZS Associates Inc) ,

    Welcome to Microsoft Q&A .Thank you for reaching out to us.

    After reviewing the reported behavior, the observations appear to be related to three separate areas of the current Preview implementation. While the successful semantic model connection suggests that the foundational configuration is functioning correctly, the remaining behaviors are influenced by service characteristics, validation requirements and the supported authentication model.

    1. Fabric IQ intermittent failures The successful semantic model connection indicates that Fabric IQ is able to establish connectivity and access the configured data source. As a result, the focus shifts from initial setup toward runtime behavior. Since Fabric IQ is currently a Preview capability, temporary service interruptions, intermittent failures, or occasional inconsistencies can occur while the platform continues to evolve. Preview services are not covered by SLA and may have constrained functionality. To help isolate the cause, the following validation steps are recommended in order:
      • Confirm that the semantic model remains available and has not been renamed, removed, or moved.
      • Verify that the Fabric IQ connection continues to show a healthy connected state.
      • Re-authenticate the delegated OAuth connection to eliminate session expiration or token-related issues.
      • Confirm that permissions to the Fabric workspace, semantic model, and underlying data sources remain unchanged.
      • Review Fabric Capacity health and utilization where applicable.
      • Retry failed requests after a short interval to determine whether the behavior is transient.
      • Review Azure Service Health for any relevant advisories, maintenance events, or service issues affecting the environment
    2. Work IQ / MCP server domain validation Separately from the Fabric IQ behavior, the reported MCP validation error appears to occur during endpoint or domain validation. Because MCP validation takes place before normal request processing begins, this issue should be treated independently from semantic model connectivity. The exact validation message is important because it identifies where the validation sequence is failing. The following checks are recommended:
      • Review the complete validation error returned by the service.
      • Verify that the configured MCP endpoint exactly matches the documented endpoint requirements.
      • Confirm that HTTPS is being used and that no additional characters or formatting issues exist in the endpoint configuration.
      • Validate endpoint accessibility and network connectivity from the hosting environment.
      • Determine whether a built-in Work IQ connector or a custom MCP configuration is being used.
      • Compare the configuration against the documented Work IQ and MCP requirements.
    3. Authentication and hosted agent identity support The current authentication model is based on delegated Microsoft Entra ID authentication. Fabric IQ evaluates requests in the context of the signed-in user and applies existing permissions and governance controls. This behavior is part of the current design and helps ensure that access remains aligned with established security boundaries Currently supported authentication approaches include:
      • Delegated Microsoft Entra ID authentication.
      • User consent flows.
      • On-Behalf-Of (OBO) authentication.
      For scenarios requiring application-based authentication, Fabric Data Agents currently support Service Principal authentication in Preview. This requires:
      • Enabling Service Principals for Fabric APIs.
      • Workspace access for the Service Principal.
      • Read access to all underlying data sources attached to the Data Agent.
      Current documented limitations include:
      • Managed Identity authentication is not supported for Fabric Data Agents.
      • Service Principal support remains a Preview capability and may have scenario-specific limitations.

    The following references might be helpful , please check them out

    Please let us know if the response was helpful

     

    Thank you

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.