Work IQ Usage Detection¶

Two-tier (configuration + telemetry) detection of Microsoft 365 Work IQ usage by Copilot Studio and Copilot agents, classifying every agent into a canonical four-state observed-usage model for per-zone feature-enablement governance and usage analytics.

Mapped Controls¶

2.24, 3.2, 2.9

Prerequisites¶

Role	Requirement
`power-platform-admin`	Power Platform Admin tenant role and a Dataverse environment with the fsi publisher prefix, for reading botcomponent / aipluginoperation metadata (Tier-A) and writing fsi_wiqstate / fsi_wiqkpi.
`security-admin`	Security Admin for Microsoft Defender XDR Advanced Hunting (CloudAppEvents, AgentsInfo) and Purview Audit (CopilotInteraction, AIPluginOperation) access used by the Tier-B telemetry queries.
`log-analytics-reader`	Reader on the Copilot Studio Application Insights resource for the Tier-B customEvents invocation query.

Dependencies¶

copilot-agent-inventory

Verification¶

Run the nightly classify flow (or Get-WorkIqConfigState.ps1 joined with the Tier-B queries) and confirm one fsi_wiqstate row per agent is written with a populated observedstatus, plus an fsi_wiqkpi rollup row.

Documentation¶

Document
Architecture
Dataverse Schema
Flow Configuration
Prerequisites

View source on GitHub { .md-button }