We are testing the Work IQ MCP server (via the @microsoft/workiq CLI, stdio MCP bridge) in our Microsoft 365 tenant (a nonprofit organization).
Setup:
- A pay-as-you-go billing policy (Copilot Credits) is active in the Microsoft 365 admin center, billed to an Azure subscription.
- The policy targets the Work IQ API service only, scoped to a security group whose only member is the test user.
- Limits: 100 credits/month total and per user. Alerts enabled.
- Service principals for "Work IQ" and "Agent Tools" were created in the tenant (both returned 201).
- The test user has no Microsoft 365 Copilot license.
Observed behavior:
- Authentication (workiq auth login) succeeds.
- Metadata tools work fine: search-paths and get-schema both return results.
- Any data tool call fails, e.g. workiq fetch --urls '/me/messages?$select=receivedDateTime&$top=3' returns: "The caller is not entitled to use this tool. Please check your billing policy and AI credit entitlement."
The same behavior persists after waiting and retrying.
This matches the symptom described in an existing question titled "Work IQ MCP Tool Access Issue" (question 5933714), where only users holding a Microsoft 365 Copilot license in addition to the PAYG policy could execute tools.
Questions:
- Can Microsoft confirm whether Work IQ MCP tool execution for users without a Microsoft 365 Copilot license is currently supported via a PAYG billing policy alone (during preview)?
- If PAYG-alone is intended to work, is there a propagation delay or additional configuration required (e.g., a different target service in the billing policy for CLI/MCP access)?
- If a Copilot license is currently required, is PAYG-only access planned for GA?