Welcome back. In the previous episodes,

we explored how Work IQ understands work

and how that intelligence becomes

accessible to other agents through A2A.

Today, we're focusing on the execution

layer, how intelligence safely turns an

action using Work IQ MCP and CLI.

Work IQ MCP allows Copilot agents to

securely observe, retrieve, reason over,

and act across M365 workloads, including

files, emails, meetings, chats,

calendars, SharePoint sites, business

systems, and collaboration artifacts.

And every interaction is permission

trimmed, auditable, and compliant by

design.

For developers, this unlocks powerful

scenarios. Using familiar environments

like GitHub Copilot CLI, you can invoke

Copilot-grade intelligence to securely

access and reason over documents in your

M365 tenant. All without bypassing

identity permissions or governance.

>> Welcome to the third episode of the Work

IQ series. I'm Paolo Pialorsi, senior

cloud advocate. And today, we're going

to talk about Work IQ with MCP and CLI.

So, first of all, in order to better dig

into the topic, let's start from a recap

of the architecture of Work IQ.

Work IQ APIs is based on chat, the chat

experience, on context, the context of

the user interacted with Work IQ API, a

set of tools to provide actual actions

on top of the chat and the context, and

workspaces whenever we need to run

long-running tasks in Work IQ through

the Work IQ APIs. Behind the scenes, we

have all of the organizational

intelligence we have inside of our

organizations. And the goal of Work IQ

and Work IQ APIs is to make it possible

to unlock the organization intelligence

to every agent out there. And that's why

we provide Work IQ API through three

different protocols. We have the A2A

protocol, agent to agent, that you have

already seen in the previous episode

with Aisha and Dara. We have the REST

protocol, and we have the MCP protocol,

which is the actual topic of this

episode.

So, first of all, let me try to explain

you why we need MCP as a protocol

supported and offered by work IQ APIs.

Well, MCP stands for model context

protocol, and it is an open source

standard that you can use to connect

applications to external systems. MCP,

we used to say that it is almost like a

universal plug for AI. And in fact, you

can think about MCP as like as when you

think about a USB-C connector for your

own devices like a smartphone or a

tablet. Well, with MCP, you connect one

agent with external services and tools

to do actions, to request the execution

of actions outside of your agents. This

is really powerful because it helps

developers to easily create agentic

solutions relying on external services

and capabilities. And it also allows the

users to interact with their agent using

natural language and allowing the

orchestrator of the agent to understand

what is the best MCP tool to use, to

invoke, to achieve the goal of the user.

So, starting from this

point of view, we can better understand

why in work IQ we have support for MCP.

And specifically, we introduced with

work IQ API a unified work IQ MCP

server, which is a server that allows us

to have through a set of generic tools

the capability to work with all of the

information and all of the intelligence

we have inside our Microsoft 365

ecosystem and more. So, for example,

with the unified Work IQ MCP server, we

can get direct access to mails,

calendar, files, people, chat, and more

of the content that we have in our

organization. We can provide also the

ability to do actions on top of data.

So, we can not only retrieve the data

and their information, but we can also

execute actions on top of that data

based on the verbs that we are going to

use. So, we can ask for something, we

can fetch, we can create, update, and so

on so forth as I will show you shortly

in a actual demo. And based on the

resource path that we use to make a

request against and targeting the

unified MCP server or Work IQ, we can

get different results and we can target

different resources. And the overall

idea is that through this MCP server, we

can get a different shape of the

response based on the actual content

that we are targeting. And that's why we

also have a get schema tool that we can

use to dynamically discover the shape of

the data that we're going to use.

With this technology, with this

protocol, the agents consuming the Work

IQ MCP protocol can dynamically

understand the data and the options that

are available for them so that we can

easily create agentic-based solution

that can interact with the knowledge and

with the with the intelligence we have

inside our organizations.

One of the scenarios where we can use,

for example, Work IQ and Work IQ MCP is

through the CLI tools that we have in

Work IQ. And in fact, we have a Work IQ

CLI that can rely on the MCP protocol to

give you at CLI level

information and content about what you

target with your prompts and with your

requests. And the same happens with a

really powerful tool that I really love,

the GitHub Copilot CLI, which can rely

on a plugin for Work IQ, which again

under the cover uses the MCP protocol to

reach all of the content, all of the

information and the intelligence we have

inside of our organization. So, now

I think it is really interesting to dig

into the actual practical demo of what

you can do with Work IQ and Work IQ MCP.

So, I'm going to switch to demo

environment and show you how you can in

practice rely and benefit of Work IQ

MCP.

This is my demo environment. I'm in a

demo tenant. And in order to use Work IQ

through any of the protocols offered by

Work IQ API, you always need to have a

security in place. And the security for

Work IQ is based on open authorization

and Entra ID since the content we target

is inside our tenant. So, here for

example, I have the Work IQ

application registered in my tenant. And

you can find additional information

about how to register Work IQ in your

own tenant as well by going to the

website related to this series of

episodes. And I will share a link with

you right after this demo. And once you

have registered the Work IQ in your

tenant, you can easily register also a

consumer application that you can use to

retrieve an access token, an open

authorization access token, and to get

access through that access token

securely to the content of

Work IQ and of your organization. So,

let me show you how it works. Here for

example, I have a Work IQ consumer

application that I registered in my

tenant. In this application, of course,

since it is a name Friday application, I

have a client ID, which is the unique ID

of my application, and I have a target

tenant ID.

Plus, in the authentication settings, I

have a bunch of options to use this

application and to authenticate when

consuming Work IQ through this

application. Then, when it comes to the

security part and the retrieval of the

token, when we use the client credential

protocol, we can also rely on a client

secret that I registered for this

application. And then in the API

permission section, I have a specific

permission granted to this application.

The permission is called Work IQ

Agent.Ask,

and this is actually a permission which

is part of a set of permission that we

have available. If we go to APIs my

organization uses and we search for Work

IQ.

Here we see we have Work IQ, and this is

a very important information. When it

comes to Work IQ, we can select

delegated permissions, which means

permissions which will allow us to

create or to request an access token

under the identity of a specific user.

This is really important because it

means that when we consume Work IQ API

with MCP or with whatever else the

protocol we like,

what happens under the cover is that we

are going to consume Work IQ with the

identity of a specific user, and as

such, we can get the security context

and the intelligence context of that

specific user. So, all of the memory,

all of the settings, all of the

information are those of the user we use

or of the token we use to access Work

IQ. So now, I'm configuring a delegated

permission,

and the delegated permission I'm going

to use is the Work IQ Agent.Ask, which

is the one I'm going to use to interact

with an ask request with Work IQ through

MCP. And this is is permission that I

already granted to my uh demo

application, so it's already there. It's

already granted by uh the uh admin of

this tenant. So, now what I need to do

is just to make the uh open

authorization handshake to retrieve an

access token, and then I will be able to

unlock the capabilities and start

consuming Work IQ through MCP. So, what

I'm going to do is going to use the MCP

Inspector, which is a really powerful

tool that we can use to inspect, as the

name implies, the behavior of an MCP

server. And what I'm going to do is to

first of all go through the open

authorization handshake. And then, uh

once I've got an access token, I will be

able to consume MCP.

So, just to give you an idea, and just

for the sake of completeness, in the

authentication settings, I configured

the ID of the application that I was

showing you before. I have the secret

that we uh show uh we saw before. I have

the redirect URI, and I have the

permission scope that I need, which is

the Work IQ Agent.Ask, that I was

talking about before. So, now, once I

have all of these settings in place, I

can go through the quick authentication

flow.

Which means that I'm going to

authenticate with the user account I

have in the target demo tenant that I'm

using, and once I've got back an access

token, I can securely connect to Work IQ

API over the MCP protocol. And now, I

can list all of the tools, the MCP tools

available through the unified MCP server

of Work IQ.

As you can see, we have the Ask tool,

which allows me to ask a question to my

Citrix Workspace Copilot uh to get back

information about email, meetings,

files, and so on and so forth. But, I

can also do stuff like, for example,

list all of the agents so that I can

target a specific agent. I can work with

specific entities like delete one

entity, do an action, create an entity,

the get schema I was referring to

before, and so on and so forth. So, we

have something like 10 different tools,

which allows us, through this unified

MCP server, to achieve our goal

interacting with all of the content and

the intelligence we have in our target

tenant. So now, let's say that I want to

rely on the ask

uh tool. So, let's say that for example,

I want to start from a very basic uh

request. So, in this tenant, uh despite

I know who I am, I want to make a prompt

question for who am I, what is my role?

This will be my initial prompt that I'm

going to ask through this tool to the uh

Work IQ MCP server. Takes a while, it is

processing my request, and I will get

back a response, which is not just the

raw data that I'm looking for, but it is

actually a response based on the

intelligence on the LLM that I have

backing uh Work IQ. So, it will not just

be my name, it will actually be a more

comprehensive response about the

information and the intelligence that I

have in my tenant. Should be here in a

matter of 2 seconds, and we get the

answer, you will be able to see and to

appreciate the quality of the answer we

get, and here we are. The request was

successful, and as you can see here,

I've got back an answer, which is a rich

answer with information about who I am,

with deep links to information to dig

into the answer and stuff like that. And

this is indeed really powerful, and it

is available to any agent that want to

use the MCP protocol to rely and to

consume the Work IQ MCP unified server.

But now, we can even do more. For

example, in this demo tenant, I've got

an email from myself from another

account, and in this email, I have the

description of an hypothetical software

project that I want to create for a

customer. So, as you can see in this

email, we have information about the

goal of the project, the data structure

for this software project, which is a

project to do software

based project management. We have some

technical requirements and so on and so

forth. So now, let's imagine that we

want to rely on the NCP server of Work

IQ to get information about that

specific email, but we don't want to

extract the raw content of the email. We

actually want to process the information

inside the email to get a meaningful

response based on what what's inside the

actual email. So, my next question would

be what are the main requirements of an

email that I've got about a new project

management software for Java insurance.

This will be my question. And let me ask

this question. And now,

again, thanks to the intelligence of

Work IQ behind the scenes, the engine

will retrieve the information in the

email I'm looking for, will process with

the intelligence layer the information,

and will give me the answer based on

what I'm really looking for. So, not the

whole content of the email, but actually

the main requirements that are defined

and described in that specific email. So

that if I have an agent which is willing

to process this information, it will be

able to start from the preprocessed

response that I've got back from the NCP

server. And again, the request was

successful, and here I can see that I

found a relevant email with this

information here and this and that. And

I can see the functional requirements,

and I can see all of the information

extracted through the intelligence of

Work IQ based on the actual content of

the email.

Now, this is cool, but we can even do

more. In the shoes of a developer, for

example, let's imagine that you have got

this email and you want to use it to

actually do something on top of this

email with the technical and functional

requirements. So, that's why I'm

switching to my console environment. And

here, of course, we can use one tool

which is the Work IQ CLI tool, which is

a common line tool that we can use and

you can install on your environment. And

through this one, we can simply say Work

IQ and we can, as you can see, ask

a specific question and provide a uh

text for the question we want to uh uh

send to the Work IQ MCP server.

This is one option. But another option

we have is also to rely on tools like or

agents like GitHub Copilot CLI. So, I

can start Copilot with the banner

because I like I love the banner of

GitHub Copilot.

Now, I'm going to start GitHub Copilot

CLI. And what I'm going to do within the

context of GitHub Copilot CLI, since in

GitHub Copilot CLI, I have the plugin

for Work IQ as I will show you shortly,

I can provide exactly the same prompt,

but I can also use the output of the MCP

request I'm going to make to Work IQ to

actually process the response and create

scaffold on the fly with back coding a

solution based on those functional

requirements. Just to give you an idea

of the power of this technology. So, I

can search, for example, for the plugin

that I have and I can list all of them.

And you can see that I have the plugin

for Work IQ inside GitHub Copilot CLI.

And what I can do now, again, as like as

I did before, is to provide the same

exactly the same prompt as before. So,

what are the main requirements of the

email that I've got about the new

project for Zava Insurance? Cool. Now,

this request will trigger a request to

the MCP server of Work IQ.

And by doing so, I will be able to have

inside the context of my uh GitHub

Copilot agent, and of course I need to

consent to make these tool request. This

is what I'm doing, and you can see MCP

Work IQ is the uh ask tool that I'm

going to use right now. By doing so, in

the context of my GitHub Copilot agent

instance, I will then have all of the

technical and functional requirements of

my solution. And as such, I can say,

"Okay, let's create a solution which is

compliant with the requirements I got

from the customer." Of course, I'm not

going to do that right now because it

will take quite some time to do the the

whole scaffolding of the solution. But I

think you have got the idea, right? You

can go through Work IQ and through the

MCP protocol, you can retrieve

information from your organization, and

you can provide that information to any

external agent, which can of course be

any technology, and can also be GitHub

Copilot CLI if it is the scenario where

you want to use the organization

intelligence to do a scaffolding and

write coding of custom developed

solution. And as you can see here, I

have the functional and the technical

requirements. And so, I could say,

"Okay, so now let's create an

application. Let's write code an

application based on these

requirements." I think it is a really

really powerful technology. So, let me

briefly switch back to the slide deck

just to wrap up. And what I want to

remind you is that if you are interested

in this technology, you should

definitely go to akms/iq-c.

There you will find videos and cookbooks

about the

Foundry IQ and Work IQ technology, and

soon there will also be Fabric IQ so

that you can dig into the Microsoft IQs,

and you can learn more about how to

leverage this powerful platform to

create agentic solutions which rely from

any technology on the intelligence and

information we have inside our own

organizations.

That said, thank you, and it's now time

for a quick recap doodle from Tomomi.

Thank you so much.

>> Hey, this is Tomomi, and here's my

recap.

In this part, the focus is on MCP, model

context protocol.

This is what allows agents to call Work

IQ as a set of tools.

So, instead of just generating answers,

it can pull real context from Microsoft

365 and take action.

Through the unified MCP server, Work IQ

exposes Microsoft 365 to access things

like chats, files, emails, and even work

data.

So, now agents aren't just reasoning,

they can actually access and operate on

real enterprise data in a structured

way.

>> [snorts]

>> You can try this out with command-line

tools to interact with Work IQ directory

from your terminal.

You have the GitHub Copilot CLI, which

is an conversational AI assistant. Also,

you have the Work IQ CLI tool.

Or you can just use GitHub Copilot CLI

with Work IQ as a plugin to bring the

enterprise context.

If you ask, "Who does John report to?"

Copilot can call Work IQ, pull that org

context, and return the real answer.

Work IQ MCP gives an agent a standard

way to connect, pull context, and take

action.