Work IQ reached general availability on 16 June 2026. If you manage Microsoft 365 at an organisation on E7 or with Agent 365 licences, you'll encounter it in conversations about Microsoft Scout, Copilot Cowork, and the broader agentic Microsoft 365 roadmap. Here's what it actually is, what IT admins need to configure, and what the governance implications are.
Microsoft Graph gives you access to raw Microsoft 365 data — emails, calendar events, SharePoint files, directory records. Work IQ gives you the understanding. It's an intelligence layer that sits above the raw Graph data and maintains a continuously updated semantic model of how your organisation actually works: who collaborates with whom, which projects are active, what "the Q3 report" means in the context of your tenant, which meetings led to which decisions.
Work IQ is organised into four capability domains: Chat handles conversational intelligence. Context retrieves organisational understanding — who's involved in a project, what related content exists. Skills gives agents access to pre-built capabilities like scheduling, searching, and creating content. Workspaces gives agents somewhere to store intermediate state across multi-step tasks.
Work IQ is included with Microsoft 365 E7 as part of that plan's agentic capabilities bundle. It's also available on a consumption basis — billed through Copilot Credits — for developers and organisations building on the Microsoft 365 platform. If your organisation is on E3, E5, or Business plans and not building custom agents, Work IQ doesn't require immediate action.
Work IQ is not enabled by default. Configuration happens through the Microsoft 365 admin centre: enable Work IQ for your tenant, set user consent preferences, and configure spending limits for consumption-based billing.
The spending limit configuration is the most important step. Work IQ is billed per-call through Copilot Credits. Without a spending limit, a misconfigured agent or unexpected usage pattern could generate significant unexpected costs. Microsoft's admin centre includes a cost management dashboard for Work IQ and Copilot Credit consumption — configure this before any broad Work IQ deployment.
The AADSTS650052 trap: The most common issue administrators encounter when enabling Work IQ is an AADSTS650052 error during the user consent flow. This typically indicates that your enterprise application consent settings are blocking Work IQ consent. You need to either approve the Work IQ application manually in Entra admin centre → Enterprise applications, or temporarily enable user consent for specific applications before completing the Work IQ setup.
Work IQ accesses the same data as your users — permission-scoped to what the authenticated user can see. Your existing permission structure, sensitivity labels, and DLP policies all apply. But Work IQ's semantic indexing creates a higher-level understanding of your data that aggregates across the tenant. The governance question is: is your data governance mature enough that you're comfortable with an AI system building a semantic understanding of how your organisation works? If you have well-applied sensitivity labels, appropriate SharePoint permissions, and active DLP policies, the answer is likely yes. If your data governance is inconsistent, Work IQ will surface those gaps more visibly than raw Graph API access would.
Microsoft Scout is the autonomous agent that uses Work IQ as its primary intelligence source. Scout was unveiled at Build 2026 and is currently in preview for Copilot Frontier customers, with GA targeted for October 2026. From an IT administration perspective, Scout will appear in your tenant with its own Entra ID identity once it's available to you, reviewable through agent management controls at Microsoft 365 admin centre → Settings → Copilot → Agent management.
M365Clarity surfaces your Copilot tier, what's included, what's not, and whether your governance is ready for the next step.
Run a free scan →Related articles