---
name: Work IQ API Access and Tool Call Governance Audit
description: Audits which agents have Work IQ API grants giving them access to Microsoft 365 organisational context — calendar, email, org chart, files — verifies that all tool calls stay within the tenant trust boundary, and checks Defender for tool-call audit trail completeness.
---

# Work IQ API Access and Tool Call Governance Audit

> **TL;DR:** This skill audits which agents hold Work IQ API grants for Microsoft 365 organisational context (calendar, email, org chart, files), verifies tenant trust boundary enforcement, and checks whether every Work IQ tool call is captured in the Defender and Purview audit trail.

## What does the Work IQ API access audit cover?

Work IQ APIs reached general availability on 16 June 2026. Work IQ is the intelligence layer that gives enterprise agents governed access to Microsoft 365 organisational context: user calendars, email threads, org chart relationships, files, and meeting transcripts. Agents access this context through Work IQ MCP servers, which act as the governed gateway — all data, context, and insights stay within the Microsoft 365 tenant trust boundary, and every tool call is auditable. However, the governance question is: **which agents have been granted Work IQ API access, what organisational context can they read, and is the audit trail actually being captured?** This skill answers all three questions by reviewing API grants, MCP server configuration, and Defender/Purview audit completeness.

## When should you run this skill?

- "Audit which agents can read our calendar, email, or org chart data"
- "Verify Work IQ tool calls are being logged for compliance"
- "Check that no agent has Work IQ access beyond its stated purpose"
- "Produce Work IQ governance evidence for a privacy or IRAP review"
- "Identify agents with broad organisational context access that have no audit trail"
- "Review Work IQ API grants before granting developer access"

## How this skill works, step by step

1. Sign in to the Microsoft 365 admin centre → Agents → Tools → Work IQ MCP servers
2. For each Work IQ MCP server that is in Allowed status: record the tools it exposes (e.g. `get-user-calendar`, `get-email-thread`, `get-org-chart`, `get-user-files`, `get-meeting-transcript`)
3. In Microsoft Entra admin centre, identify the service principals (agents) that have been granted the Work IQ API permissions: search for applications with `WorkIQ.Read`, `Calendar.Read`, `Mail.Read`, or `OrgChart.Read` scopes granted via admin consent
4. For each agent with Work IQ grants: record the agent name, owning team, grant date, and the specific organisational context scopes granted
5. Assess the principle of least privilege: does the agent's purpose justify the context scopes it holds? Flag agents with email read access that do not have a documented email-processing workflow
6. Check the tenant trust boundary: verify that Work IQ MCP servers are configured to operate within the Microsoft 365 tenant boundary — no data should flow to external endpoints via Work IQ tool calls
7. Open the Microsoft Purview unified audit log: search for Work IQ tool call events (event type `AgentToolCallCompleted`, `WorkIQContextAccessed`) for the review period
8. Cross-reference the audit log events against the list of agents with Work IQ grants: identify any agent in the grants list that has no audit log events (grant exists but no tool calls, or tool calls are not being logged)
9. In Microsoft Defender, check asset-context records for Work IQ-enabled agents: confirm that the Work IQ MCP server is listed as a tool surface and that Defender policy controls are applied
10. Produce the access inventory and audit completeness summary below

## Output format

### Work IQ API grants inventory

| Agent name | Owner team | Work IQ scopes granted | Grant date | Tool calls (30d) | Audit log present | Risk |
| --- | --- | --- | --- | --- | --- | --- |
| Executive-Briefing-Agent | Executive Office | Calendar.Read, Mail.Read, OrgChart.Read | 2026-05-12 | 847 | Yes | Medium — broad context; verify purpose |
| Procurement-Approval | Finance | Files.Read | 2026-06-01 | 12 | Yes | Low |
| Unknown-Agent-7 | Unknown | Calendar.Read, Mail.Read, Files.Read, OrgChart.Read | 2026-04-30 | 0 | No | Critical — all context scopes, no owner, no audit trail |

### Audit completeness summary

- Agents with Work IQ API grants: N
- Agents with least-privilege scopes (single context type): N
- Agents with broad context grants (3 or more scope types): N
- Agents with Work IQ grants but zero audit log events: N (Critical)
- Agents with Work IQ grants but no Defender asset-context mapping: N
- Tenant trust boundary verified: Yes / No
- Recommended actions: revoke grants for agents with no owner or documented purpose; enable Defender policy controls for broad-context agents; investigate agents with grants but no audit events

## Scope and safety

Read-only — this skill does NOT:

- Revoke or modify Work IQ API grants
- Change Work IQ MCP server configuration
- Alter Defender policies or audit log settings
- Access the content of email, calendar, or file items retrieved by agents

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Work IQ APIs and MCP servers | Microsoft Agent 365 (included in M365 E7, or standalone) |
| Defender asset-context mapping for agents | Microsoft Defender for Endpoint Plan 2 or Microsoft 365 Defender |
| Purview unified audit log — tool call events | Microsoft 365 E5 Compliance or Microsoft Purview add-on |

### Least-privilege roles

- Global Administrator or AI Administrator (read Work IQ MCP server configuration)
- Application Administrator (enumerate Entra app registrations and API permission grants)
- Compliance Administrator (query Purview audit log for Work IQ tool call events)
- Security Reader (read Defender agent asset-context records)

### Microsoft Graph permissions (read-only)

- `Application.Read.All` — enumerate agent service principals and their Work IQ API permission grants
- `AuditLog.Read.All` — query Purview unified audit log for Work IQ tool call and context access events
- `Policy.Read.All` — read Entra admin consent policies applied to Work IQ grants

## Sources and compliance

- [Announcing the new Work IQ APIs (Microsoft 365 Blog)](https://www.microsoft.com/en-us/microsoft-365/blog/2026/06/02/announcing-the-new-work-iq-apis/)
- [Work IQ MCP overview — Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-copilot-studio/use-work-iq)
- [Work IQ: Production-ready intelligence for every agent (Microsoft 365 Developer Blog)](https://devblogs.microsoft.com/microsoft365dev/work-iq-production-ready-intelligence-for-every-agent/)
- Supports the Privacy Act 1988 (Cth) — agents with access to personal information (email, calendar) must have a documented lawful basis and audit trail
- Aligns with APRA CPS 234 — information assets accessed by third-party (agent) processes must be identified and governed
- Aligns with ISM Control 1603 (access to data limited to what is required for the specified purpose)
- Pair with Agent 365 Tools and MCP Server Governance Baseline for full tooling governance coverage
- Output in Australian English