Microsoft Work IQ API: Build Enterprise AI Agents

Microsoft's Work IQ API reached general availability on June 16, 2026, and it fundamentally changes how developers build enterprise AI agents. Instead of wiring together custom data pipelines, permission systems, and compliance checks, Work IQ wraps all of that complexity into a single intelligence layer that agents can query over three protocols: Agent-to-Agent (A2A), Model Context Protocol (MCP), and REST.

This guide covers what Work IQ is, how each protocol works, and how to get your first agent reasoning over Microsoft 365 data in minutes.

What Is Work IQ?

Work IQ is Microsoft's workplace intelligence layer—a unified API surface that lets AI agents access and reason over organizational data including email, calendar events, Teams messages, SharePoint documents, OneDrive files, and people context. It sits between your agents and raw Microsoft 365 data, handling authentication, permission trimming, and compliance enforcement automatically.

The key insight is simple: enterprise AI agents need organizational context to be useful, but building that context layer correctly is hard. You need OAuth scopes, delta sync jobs, vector stores, sensitivity label handling, and audit logging. Work IQ eliminates all of that by making it a platform concern rather than a developer concern.

Why Work IQ Over Custom Pipelines?

Traditional enterprise AI integrations require you to:

1. Extract and index data from various M365 APIs
2. Maintain vector stores for semantic search
3. Handle permission trimming manually (ensuring an agent cannot read data the user cannot read)
4. Implement compliance policies and audit trails
5. Manage token refresh, rate limiting, and error handling across dozens of Graph API endpoints

Work IQ collapses this into a single, policy-aware API endpoint. Every request is automatically scoped to the signed-in user's permissions. Sensitivity labels are respected. Audit logs are built in.

What Data Can Agents Reason Over?

Work IQ surfaces six categories of workplace data:

• Email messages — read, search, and summarize inbox content
• Calendar and meetings — query upcoming events, meeting context, and attendees
• Files — access documents in OneDrive and SharePoint
• Teams messages — search channels and conversations
• People context — organizational hierarchy, expertise, and relationships
• Enterprise search — cross-data-source semantic search

All data is served through the same endpoint, permission-trimmed in real time.

Three Protocols, One Intelligence Layer

Work IQ supports three interaction protocols, each suited to a different integration pattern.

A2A: Agent-to-Agent Protocol

Use A2A when your agent needs to delegate work to Work IQ as a peer agent. This is ideal for multi-agent systems where a coordinator agent offloads M365-specific tasks.

A2A uses a JSON-RPC envelope and posts to a single base URL. The method name lives inside the request body, not the URL path.

POST https://workiq.svc.cloud.microsoft/a2a/
Authorization: Bearer {access-token}
Content-Type: application/json
A2A-Version: 1.0
 
{
  "jsonrpc": "2.0",
  "id": "req-001",
  "method": "SendMessage",
  "params": {
    "message": {
      "role": "ROLE_USER",
      "messageId": "msg-001",
      "parts": [
        { "text": "What meetings do I have this afternoon?" }
      ],
      "metadata": {
        "Location": {
          "timeZone": "Africa/Tunis",
          "timeZoneOffset": 60
        }
      }
    }
  }
}

The response includes a task artifact with the answer:

{
  "jsonrpc": "2.0",
  "id": "req-001",
  "result": {
    "task": {
      "id": "task-abc",
      "contextId": "ctx-xyz",
      "status": { "state": "TASK_STATE_COMPLETED" },
      "artifacts": [
        {
          "parts": [
            { "text": "This afternoon: 2 PM client review, 4 PM team standup." }
          ]
        }
      ]
    }
  }
}

For multi-turn conversations, pass the contextId from the previous response back in subsequent messages. Work IQ maintains conversational context across turns.

When to use A2A: multi-agent systems, autonomous task delegation, agent orchestration pipelines.

MCP: Model Context Protocol

Use MCP when an AI assistant in an IDE or CLI needs to pull in M365 context dynamically as tools. Work IQ provides a local MCP server you install via the workiq CLI, which collapses hundreds of potential Graph API calls into just 10 generic tool verbs.

Configure it in your MCP-enabled environment:

{
  "workiq": {
    "type": "stdio",
    "command": "workiq",
    "args": ["mcp"]
  }
}

Once configured, an AI assistant can invoke Work IQ as a tool. For example, asking "Summarize recent project risk discussions" triggers:

{
  "tool": "workiq.search",
  "arguments": {
    "query": "project risks",
    "source": "teams"
  }
}

Work IQ returns grounded, permission-scoped results without the AI assistant needing direct Graph API access.

When to use MCP: AI coding assistants, IDEs, CLIs, any LLM-based tool that supports tool calling.

REST API: Conversational Request/Response

Use REST when you are building a web application or backend service that sends questions to Work IQ and renders responses.

POST https://workiq.svc.cloud.microsoft/v1/conversations
Authorization: Bearer {access-token}
Content-Type: application/json
 
{
  "query": "Show me emails from Dana about the Q3 forecast"
}

Work IQ returns a grounded, natural language response with relevant email excerpts, permission-filtered to what the signed-in user is allowed to see.

When to use REST: web apps, service-hosted agents, backend orchestrators that don't need agent delegation.

Choosing the Right Protocol

Authentication and Security

Work IQ uses Microsoft Entra ID delegated authentication. Every request runs in the context of a signed-in user—there is no application-only access. If a user cannot read a document, neither can an agent acting on their behalf.

Key rules:

• Use delegated flows (auth code, device code, or on-behalf-of)
• Application-only authentication is not supported
• For multi-tenant apps, register as AzureADMultipleOrgs and ensure users sign in through their home tenant's authority

The on-behalf-of (OBO) flow is particularly useful for service-to-service architectures where a backend receives a user token and exchanges it for a Work IQ token.

Pricing: Copilot Credits

Work IQ is billed through a consumption-based model using Copilot Credits—the same unified currency used for Copilot Studio and other Microsoft AI services. There is no per-user subscription or separate Work IQ SKU.

This means the cost scales directly with usage rather than headcount, which is economically favorable for agents that serve many users through a shared integration rather than individual licenses. Manage credits and monitor consumption through the Microsoft 365 admin center.

Getting Started

To build your first Work IQ integration:

1. Register an Entra app — create an app registration in Azure portal and add the Work IQ delegated permission
2. Choose your protocol — A2A for agent delegation, MCP for AI tool integrations, REST for web apps
3. Acquire a token — use MSAL or the Microsoft Identity platform to get a delegated token
4. Make your first call — send a SendMessage (A2A) or conversational query (REST) to the Work IQ endpoint
5. Configure billing — enable Copilot Credits billing in the M365 admin center to move from preview to production

The official samples repository at github.com/microsoft/work-iq-samples includes end-to-end examples for all three protocols.

What This Means for Enterprise AI Development

Work IQ represents a shift in how enterprise AI is architected. Rather than treating Microsoft 365 as a data source to scrape and index, Work IQ positions it as a live intelligence layer that agents query in real time with full governance intact.

For developers, this means less infrastructure to build and maintain. For enterprises, it means AI agents that respect the same permissions and compliance controls as every other Microsoft 365 workload.

The combination of A2A, MCP, and REST in a single API surface also makes Work IQ unusually composable. You can wire it into an existing multi-agent system via A2A, expose it to a developer's IDE via MCP, and surface it in a web app via REST—all from the same underlying intelligence layer.

Conclusion

The Work IQ API removes the hardest part of building enterprise AI agents: getting reliable, governed access to organizational data. With GA in June 2026 and a straightforward protocol choice between A2A, MCP, and REST, it is now practical to build agents that reason over email, calendar, files, and Teams without managing a custom data pipeline.

Start with the official Microsoft Learn documentation and the work-iq-samples repository to explore working code examples for each protocol.