Work IQ MCP: fewer tools, more paths
Learn to discover paths, inspect schemas, and read messages with Work IQ MCP. A read-only example shows why fewer tools do not remove access, coverage, and authorization boundaries.
Learn to discover paths, inspect schemas, and read messages with Work IQ MCP. A read-only example shows why fewer tools do not remove access, coverage, and authorization boundaries.
RAG over Microsoft 365 used to be your pipeline: a connector, a vector index, a sync job and permissions re-created by hand. Microsoft Work IQ takes that pipeline out of your hands — and charges in identity: there is no application-only authentication, every call runs as a person and tenant policy blocks writes by default. This article shows what changes, what stays with you and how to compose Work IQ with Foundry, Microsoft Fabric data agents and Databricks Genie without swapping the identity on the way.
The user prompt was clean. The hostile instruction came in through the content the tool brought back — and that is the door almost no security review looks at. This article gathers what moved in the 2026 OWASP Top 10, the two Prompt Shields intervention points, the spotlighting that ships off by default, what the MCP specification protects and what it leaves to you — and shows what has to be in place so a successful injection does not become impact.
MCP has become the open standard for connecting AI agents to tools and data. What it is, what changed in detail in revision 2026-07-28 - stateless protocol, no sessions or initialize, subscriptions/listen, no SSE resumability, extensions and OAuth - with a migration checklist and how to host it on Azure.