At Microsoft Build 2026, Microsoft unveiled a coherent intelligence ecosystem that goes well beyond the familiar Copilot chatbot. At its core are three coordinated intelligence layers: Work IQ, Fabric IQ, and Security IQ — together forming what Microsoft internally calls the «IQ stack» for Microsoft 365 and the Power Platform.

This article explains what sits behind each layer, how they interact, and what Swiss organisations can put into practice today.

A note on scope: Work IQ and Fabric IQ are partially still in preview. This article reflects the Build 2026 announcements (May 2026) and current Microsoft documentation. Feature scope and licensing details may change before general availability.

What Is the Microsoft IQ Stack?

Microsoft has used the term «IQ» since 2025 to describe specialised intelligence layers that make enterprise data, signals, and context intelligently available via API — without users having to actively search for it.

The IQ stack comprises three main layers:

Each layer is independently deployable — but the real value emerges when they work together: Work IQ provides person context, Fabric IQ provides data context, Security IQ provides risk context.

Work IQ: What Is New Since Build 2026

Work IQ received three important expansions at Build 2026. For the foundational overview, see our introductory Work IQ article.

1. Explicit Role Graph

Microsoft introduces the Explicit Role Graph: Work IQ now understands not just the formal org structure (who reports to whom) but also informal roles — who is the de-facto decision-maker on a project, who is the go-to person for technical questions in a department?

This information is derived from collaboration patterns (who responds to whose requests, whose documents are referenced most frequently) and feeds directly into how Copilot responses and agent actions are prioritised.

2. Work IQ for External Contacts

Work IQ now supports external contacts: when a customer regularly joins Teams meetings or edits files in a shared SharePoint workspace, Work IQ can (with appropriate governance configuration) provide context about the collaboration with that customer. This is particularly useful for account managers who want a quick current-state briefing before a client call.

3. Work IQ API: Public Preview

The Work IQ API entered public preview for Enterprise customers at Build 2026. This allows organisations with in-house development capacity to embed Work IQ signals into custom applications — for example, a CRM system that automatically shows the «warmth level» of a customer relationship, or a project management tool that suggests relevant contact persons for a new engagement based on Work IQ data.

For Swiss organisations building custom applications via Replit Enterprise or the Power Platform, the Work IQ API is a powerful building block for bespoke Copilot experiences.

Fabric IQ: The Intelligence Layer for Your Data

Microsoft Fabric IQ is the AI layer within Microsoft Fabric — the unified analytics ecosystem launched in 2023 that brings together Power BI, Azure Synapse, Data Factory, and additional services under a single roof.

Fabric IQ fundamentally changes how data work is done.

What Fabric IQ Does in Practice

1. Copilot in Microsoft Fabric (GA since Q1 2026)

Copilot in Fabric is the most direct entry point into Fabric IQ. It supports data teams across four core areas:

• Data Engineering: Natural-language instructions generate PySpark or SQL code for data pipelines. «Create a pipeline that normalises our daily sales data from the ERP and writes it to OneLake» — Copilot writes the code, the data engineer reviews and deploys it.
• Data Science: Within Fabric Notebooks, Copilot proposes data science workflows, explains existing code, and helps debug ML models.
• Power BI: Natural-language queries on your data («Show me the top 10 products by contribution margin in German-speaking Switzerland since January») without SQL knowledge. Copilot generates DAX queries and visualises results directly.
• Real-Time Intelligence: Fabric IQ monitors real-time data streams and proactively alerts on anomalies — without anyone needing to watch a dashboard.

2. Autonomous Data Agents (Build 2026 Preview)

The most significant Fabric announcement at Build 2026: Autonomous Data Agents — Fabric-side agents that independently monitor, repair, and optimise data pipelines.

Capabilities Microsoft has announced for Q3/Q4 2026:

• Pipeline Health Agent: Detects failed pipeline runs, analyses the root cause, and for known failure patterns (e.g. timeout caused by higher-than-normal data volume) automatically retries with adjusted parameters.
• Data Quality Agent: Continuously monitors defined quality rules (completeness, consistency, freshness) and alerts the data team when violations are detected — including which reports and dashboards are affected.
• Query Optimisation Agent: Analyses slow Power BI queries and proposes DAX optimisations or data model improvements.

3. Fabric IQ and OneLake

OneLake is Microsoft's «data lake for the organisation» — a single logical data lake connecting all Fabric workloads. Fabric IQ is tightly integrated with OneLake: it automatically creates a semantic index over all data in OneLake, enabling Copilot queries to search semantically across unstructured data (PDFs, images, e-mails) as well.

For Swiss organisations: OneLake supports EU data residency, and Fabric workloads can be configured to the Swiss region (Switzerland North / West), ensuring no data is processed outside Switzerland — important for nDSG compliance and sector-specific regulations.

Fabric IQ vs. Power BI Today

A common question: what changes for organisations already using Power BI in production?

The key point: Fabric IQ requires data to reside in OneLake. Organisations still working with standalone Power BI datasets or Azure Synapse workspaces will benefit most from a staged migration to Fabric.

Security IQ: Intelligent Threat Protection

Microsoft Copilot for Security — the Security IQ layer — was extended at Build 2026 with new autonomous capabilities:

Autonomous SOC Agents

Microsoft introduced three new Security agents designed to reduce the load on Security Operations Centres:

Triage Agent: Automatically categorises incoming security alerts by severity and context. Instead of processing 200 unfiltered alerts per day, the SOC team sees prioritised incidents with a root-cause summary and recommended next steps.

Threat Intelligence Agent: Automatically enriches incidents with external threat intelligence feeds. When a suspicious process runs on an endpoint, the agent checks whether the hash appears in known malware databases and establishes a connection to active campaigns.

Remediation Agent: For known attack patterns, the Remediation Agent can automatically initiate countermeasures — for example, isolating a compromised account, removing a malicious e-mail rule, or terminating a suspicious process — with a complete audit trail for compliance.

Security IQ and Swiss Privacy

Security IQ capabilities run entirely within the Microsoft compliance boundary. For organisations with heightened regulatory requirements (banks, hospitals, public administration):

• All Security IQ logs are captured in Microsoft Purview
• Sensitivity Labels and DLP policies apply to Security Copilot responses
• Security IQ API supports nDSG-compliant data residency in Switzerland

How the Three Layers Work Together: A Swiss Example

Scenario: Onboarding a new executive board member

Without the IQ stack: HR manually assembles access lists, IT configures permissions, the new person hunts for relevant documents, contacts, and dashboards on their own — onboarding time: several weeks.

With the IQ stack:

1. 1Work IQ detects a new person in the executive group and automatically prepares a briefing: org chart, active projects, recommended contacts, prioritised SharePoint documents.
2. 2Fabric IQ surfaces personalised executive dashboards in Power BI — automatically curated from the OneLake data relevant to this person's role.
3. 3Security IQ monitors the new account's access in the first week with elevated sensitivity, automatically escalating unusual access patterns to the IT security team.

This is not a vision — it is a combination of capabilities Microsoft plans to roll out fully by the end of 2026.

Availability and Rollout Plan (as of June 2026)

Licensing: What Do You Need for Each Layer?

An important distinction: Fabric IQ is capacity-based (you purchase compute capacity), not per-user. This makes it significantly more cost-effective for data-intensive organisations with a small number of Power BI authors compared with per-user Premium licensing.

Next Steps for Swiss Organisations

If you already use Microsoft 365:

1. 1Check whether you have a Copilot add-on. If so, Work IQ is already active.
2. 2Audit your SharePoint quality with our SharePoint Best Practices Checker — Work IQ is only as good as the content it can access.
3. 3Assess your Agentic AI readiness with our free self-assessment tool.

If you use Power BI in production:

1. 1Start a Fabric Trial (free, 60 days) and migrate one existing Power BI workspace to Fabric.
2. 2Test Copilot in Power BI with a real dataset: ask questions in natural language and review the generated DAX queries.
3. 3Identify which data pipelines would benefit most from Fabric IQ's autonomous monitoring.

If you want to strengthen your security posture:

1. 1Take advantage of the free Copilot for Security evaluation that Microsoft offers to qualified organisations.
2. 2Start with the Triage Agent on your existing Microsoft Sentinel setup.

CNEXT is a Microsoft Partner in Bern and supports Swiss organisations in adopting all three IQ layers — from licensing advice and technical implementation to the change management required for the affected teams.