Work IQ API: governance for Microsoft 365 agents

Microsoft is making the Work IQ API generally available on June 16, 2026. This gives custom agents and applications an official way to work with Microsoft 365 context — not just with raw files, emails or calendar entries.

For DACH companies, this is less another Copilot feature than an architecture decision: whoever has agents built in Microsoft 365 must clarify access, cost and traceability before the rollout.

What Microsoft is releasing

According to Microsoft, Work IQ is meant to help agents “reason” over emails, meetings, chats, files, people, collaboration signals and business systems. To do this, the API supports several access modes, including agent-to-agent, the Model Context Protocol and REST-style integrations.

The Microsoft Learn documentation describes the core as secure access to Microsoft 365 data with existing permissions, compliance and governance controls. The key point: Work IQ does not replace your permissions architecture. It uses it as the foundation for agentic workloads.

Why this becomes operationally important

The Partner Center announcement names the second lever: the Work IQ API is billed on a usage basis via Copilot Credits. Custom agents in Copilot Studio, Foundry or third-party platforms therefore incur direct consumption costs, while Microsoft’s prebuilt Copilot agents may be treated differently.

This quickly turns “we’re trying out an agent” into an operating model. IT and finance need limits, alerts, owners and clear approval processes. Otherwise shadow costs arise exactly where agents are most useful: in many small context queries, tool calls and repeated work steps.

What DACH companies should review

For regulated organizations, three questions matter before the first production agent: which Microsoft 365 data may the agent see? Which actions may it perform? And how is consumption made visible per business unit?

Don’t start with the technically most exciting use case, but with a controllable process: defined data sources, few actions, measurable benefit, a clear cost ceiling. Only once logging, permissions and billing are robust should the agent reach more systems.

The new guiding question is not “Can we build Microsoft 365 agents?” but “Can we run them so that context, cost and control fit together?”