Fabric IQ MCP Server: What AI Agents Can Read from Power BI

After FabCon Barcelona, Power BI semantic models gained a new entry point for AI agents. Microsoft-hosted Fabric IQ MCP Server became generally available in September 2026, connecting AI agents and MCP clients to Power BI reports and semantic models as a remote server. The real question worth digging into is: what exactly can an external agent see, and under what identity does it see it?

Previous approaches either required building separate integrations for each client, or relied on the still-in-preview Power BI consumption endpoint—which required administrators to enable a tenant setting and demanded build permissions on the model. Definitions were locked inside semantic models, and every agent went through its own door. IQ MCP Server attempts to unify these doors into a single HTTP channel.

Architecture: Microsoft-Hosted, User Identity Throughout

The server is hosted by Microsoft, MCP clients connect via Streamable HTTP, and sign-in uses Microsoft Entra ID, inheriting delegated permissions from the Power BI service. Service principals and app-only sign-in are not supported, so every call is backed by a real logged-in person.

The barrier to entry is lower than you might expect: no workspace role is needed, and no build permission is required—just access to a report or model. By contrast, the former consumption endpoint was heavier on both permissions and tenant configuration.<br>

This directly shapes the boundaries of applicability. The common enterprise scenario of "unattended overnight agents" doesn't work here, because there's no service principal support.

Delegated permissions vs. app-only sign-in: Delegated permissions mean an app calls a resource on behalf of a logged-in user, with the token containing that user's identity—so all permission checks, row-level security (RLS), and object-level security (OLS) are computed for that user. App-only sign-in, by contrast, uses the service principal's own identity to obtain a token, with no "person behind it," and is commonly used for unattended batch processing. IQ MCP Server accepts only the former, effectively binding "who is asking" tightly to "what they can see"—sacrificing automation scenarios in exchange for a clear audit trail and governance boundary.

Six Read-Only Tools: The Agent Writes Its Own DAX

The server exposes six read-only tools: looking up reports or models by name, resolving links, reading report metadata, reading model schema, searching stored values, and executing DAX queries. There is no "answer tool"—the agent picks tools, writes DAX, and interprets results on its own.

Row-level and object-level security still apply, so two people asking the same question may get different answers. There is also no backdoor path that lets administrators see more. Each query targets a single semantic model and returns a maximum of 250 rows by default, unless the client explicitly requests more. The current version does not yet support ontologies or data agents, which each have their own separate MCP endpoints.

This design brings "the semantic layer as interface" to the forefront: when business definitions are already embedded in a governed semantic model, agents in tools like GitHub Copilot can use those measures directly, rather than guessing from raw tables. Conversely, if the model doesn't expose the measures or relationships needed for a question, results may be incomplete or even fail.<br>

DAX and "the semantic layer as interface": DAX (Data Analysis Expressions) is the expression language used in Power BI semantic models to define measures, calculated columns, and queries. To answer a question, an agent must first learn the available tables, relationships, and measures through the schema tool, then assemble a DAX query itself. This means the measure definitions in the semantic model become the agent's "API contract"—the more complete and clearly named the measures, the more likely the agent is to produce correct results. Conversely, the agent has no fallback of "guessing from raw tables," so missing measures often manifest directly as errors or incomplete answers.

Boundaries with Fabric Core MCP Server

The two have distinctly different positioning. Core Server manages resources, workspaces, items, and roles; IQ Server is read-only—querying Power BI content without changing anything.

Drawing this line clearly helps avoid mixing read and write responsibilities into the same agent channel when making architectural decisions.

When to Use It, and When Not To

Suitable scenarios: Business definitions already exist in a governed semantic model, and you want agents in tools like GitHub Copilot to use those measures rather than guessing from raw tables. The model becomes the interface, and the agent becomes the consumer.

Unsuitable scenarios: When you need unattended jobs; when a question requires joining data across multiple models (a single query cannot join); when data freshness requirements exceed the most recent successful refresh; when the tenant's home region supports only Power BI or is a sovereign cloud (where the feature is unavailable); and when no one in the organization actually runs their own agent or MCP client.<br>

The last point is often overlooked: if no one is actually running an agent, this server has no reason to exist.

Sovereign clouds and tenant home regions: A sovereign cloud refers to a cloud environment operated independently to meet specific national or industry data residency and compliance requirements, such as Azure Government Cloud or various national clouds. Service lists, network endpoints, and feature rollout timelines in such environments typically lag behind global public clouds, so IQ MCP Server may simply be unavailable there. The tenant home region is the default geographic location where Power BI tenant data is stored and processed. If that region supports only Power BI but not all Fabric workloads, the server—which depends on Fabric—cannot be enabled either. Before planning, confirm which type of environment your tenant resides in.

General Availability Requirements and Governance Controls

Status is generally available. It requires a Microsoft Entra work or school account, a tenant whose home region supports all Fabric workloads, and access to at least one report or semantic model. Content does not need to be on Fabric or Premium capacity.

Clients will request three delegated Power BI permissions, which users can consent to themselves unless the tenant restricts user consent. Therefore, consent policy is the administrator's actual control point. Microsoft recommends pairing this server with the Fabric IQ skill—practically speaking, you really should, otherwise clients will invent their own guardrails.

Server pricing has not yet been announced. For teams planning their agent access path, this means the cost model remains a blank, and you'll need to proceed on a pilot basis.

Consent policy and Fabric IQ skill: Consent policy is a rule configured by administrators in Entra ID that determines whether users can consent to permissions requested by third-party applications on their own, or whether administrator approval is required. It's the first gate preventing agents from freely acquiring delegated Power BI permissions. Fabric IQ skill, meanwhile, is a companion capability from Microsoft that pre-provisions a set of guidance rules for AI agents on how to correctly use semantic models and tools—essentially giving the agent a "user manual." Without it, clients need to define these constraints themselves, which in practice often leads to agents making out-of-bounds calls or misusing tools.

One-line Summary

Fabric IQ MCP Server lets AI agents read-only access Power BI semantic models as a logged-in user, but only in attended scenarios.

Paragraph Summary

After FabCon Barcelona, Microsoft-hosted Fabric IQ MCP Server is generally available, connecting AI agents and MCP clients to Power BI reports and semantic models via Streamable HTTP. The server inherits Entra ID delegated permissions and does not support service principals or app-only sign-in, so every call must be backed by a real logged-in user, making unattended jobs impossible. It exposes six read-only tools, and the agent selects tools and writes DAX queries itself, with row-level and object-level security still in effect. It has a clear division of labor with Fabric Core MCP Server, which handles resource management. It suits scenarios where business definitions are already embedded in a governed semantic model, and is unsuitable for cross-model joins, high real-time requirements, and sovereign cloud environments. Pricing has not yet been announced.