Microsoft Fabric AI, Security and Real-Time Intelligence Updates: What to Adopt in 2026

Key Takeaways

• Most of the Fabric AI stack moved from preview to general availability between July and September 2026, including data agents in Copilot Studio and the Fabric IQ MCP Server.
• The security controls AI depends on are now GA: the OneLake security role experience, Purview DLP restrict access, outbound access protection and Eventhouse Private Link.
• Real-Time Intelligence now runs from event to action, with GA Eventstream connectors, Activator stateful rules, Business Events and Real-Time Dashboards.
• An operations agent acts with the delegated identity of the person who created it, so who builds it matters as much as what it does.
• Copilot and agent usage draws on Fabric capacity, so every AI pilot needs a capacity plan and a deliberate capacity overage threshold.
• The safe adoption order is access model first, governance second, AI that reads third and AI that acts on live events last.

The Alert Fired at 2 a.m. Who Approved the Fix?

Picture a regional distributor in the middle of the night. An operations agent in Microsoft Fabric watches order and stock events as they stream into an eventhouse.

It spots a fast-selling item heading for a stock-out at one warehouse. Then it posts a recommendation in Microsoft Teams to move stock from a nearby site. (This is an illustrative scenario, not a named client.)

The on-call planner taps approve, and the transfer goes ahead. Nobody stops to ask whose permissions that action used.

Microsoft’s documentation answers the question plainly. An operations agent works with the delegated identity and permissions of the person who created it. If an administrator built the agent, the 2 a.m. fix ran with administrator rights, whatever the planner was cleared to do.

That one detail also explains the whole set of 2026 changes. Fabric’s AI features, its security controls and its real-time tools arrived as separate announcements, yet each depends on the others. So this guide covers what changed in each lane and what is generally available or still in preview as of November 2026. It then closes with the order in which to switch things on.

Microsoft Fabric AI, Security and Real-Time Intelligence Updates: What Changed in 2026

The short version is that Fabric’s AI, security and streaming features grew up together over the past year and a half. This page first covered the FabCon 2025 announcements in April 2025, when much of what follows was a preview or a roadmap slide. Nineteen months later, most of those previews are generally available.

That shift also changes the question a data leader has to answer. At first, the question was what Microsoft had announced. In November 2026 it is which of these updates is safe to run against production data, and in what sequence.

A feature list cannot answer that on its own. After all, the AI features only behave well when the security and real-time pieces under them are in place.

The scope here is deliberately narrow, though. For every workload in one place, see the full Microsoft Fabric 2026 changelog. Event-by-event detail lives in the FabCon 2026 recap and the FabCon Europe 2026 announcements. This post instead stays at the point where AI, security and real-time data meet.

Then and Now: April 2025 vs November 2026

The table compares what the April 2025 version of this page reported with the state Microsoft Learn shows in November 2026. Each row is one lane, and the right-hand column is the current status.

When you read down the right-hand column, a pattern shows. The pieces that read data reached GA first, and the pieces that act on data or add new context are the ones still settling.

How to Read a Fabric Release Label

A release label tells you how much support and stability to expect, so it is worth reading each one carefully before planning around a feature. Microsoft keeps an AI feature release state table for Copilot and agent features, and it is the first place to check.

1. Generally available (GA). Supported for production use. So plan pilots and rollouts around these.
2. Preview. Usable, but behavior and limits can change before GA. Until GA, keep previews off the critical path of anything a customer or regulator depends on.
3. Rolling out. Announced as GA, yet not yet in every tenant or region. Confirm the feature appears in your own tenant before you schedule work around it.

Status is only half the check. For example, Copilot in Fabric needs an F2 or larger capacity, or a Power BI Premium P SKU, in a supported region. It also does not run on trial SKUs. Operations agents do not run on trial capacities either, so a free trial is a poor test bed for this set of updates.

The 2026 Update Register: What Is Generally Available and What Is Still in Preview

A register lists each update beside its release status, so that a team can sort what to use now from what to watch. The one below covers only the AI, security and real-time lanes. Every row comes from Microsoft Learn, mainly the What’s new in Microsoft Fabric page, as checked on November 13, 2026.

Use it the way an architecture board would. Anything marked GA can enter a production plan once the prerequisites are met. Anything marked preview instead goes on a watch list with a named owner, who checks its status each month.

The Register, Lane by Lane

What the Count Shows

The count is telling, as long as you read it as rows. Of the 15 rows, 12 are generally available and three are still in preview. Several rows bundle three or four related updates, so treat them as 15 update groups, not 15 features.

The three preview rows sit at the edges, where AI gains new context, identities or oversight. The core reading and alerting paths are already GA.

One nuance needs care. Microsoft’s data agent concepts page calls the data agent itself generally available. The AI feature table, however, still lists a combined row for data agents, AI functions and AI services as preview. So the safe reading is that the data agent is GA and several related capabilities are not.

AI Updates: Copilot, Data Agents, Operations Agents and Fabric IQ

Fabric now has four layers of AI help, and each one does a different job for a different person. Copilot, for example, assists the people building in Fabric. Data agents answer business questions, operations agents watch live data, and Fabric IQ supplies the business meaning that keeps all of them consistent.

Think of a sales operations analyst. She might use Copilot to draft a KQL query and a data agent to answer a manager’s question about pipeline. Then an operations agent could flag a sudden drop in orders.

Each of these has different setup, risk and cost, so they are worth separating. For a deeper look at how they divide the work, see the guide to Copilot and agents in Fabric.

Copilot in Fabric: On by Default, Paid From Capacity

Copilot in Fabric is the assistant built into each workload, and its release state differs by workload. According to Microsoft’s Copilot in Fabric overview, it is on by default for tenants with paid F2 or larger capacity.

Copilot is GA in Power BI, Data Factory, SQL database and Real-Time Intelligence. In the streaming lane, that covers the KQL queryset and Real-Time Dashboard experiences. Notebook Copilot and Data Warehouse SQL Copilot are still preview. So check the workload before you promise Copilot to a team.

Cost is the catch. Copilot usage consumes Fabric capacity, and heavy use can cause throttling for other work on the same capacity. Microsoft provides a Fabric Copilot capacity as an option for steering that usage to a capacity you choose. Teams that want setup detail can follow the Copilot in Microsoft Fabric guide.

Fabric Data Agents: GA Core, Preview Edges

A Fabric data agent lets people ask questions in plain language and get answers from governed data. The data agent concepts page describes it as generally available. It can draw on a warehouse, lakehouse, semantic model, KQL database, mirrored database or ontology.

Two rules make it a security story as much as an AI one. A user needs read access to the underlying data before the agent will answer from it. The agent also respects Purview DLP and access restriction policies, so a well-built permission model carries straight through to the answers.

Each 2026 addition extends that security story rather than bypassing it. The Copilot Studio integration went GA in August 2026. It adds a data agent to a Copilot Studio agent as a Fabric IQ Data MCP tool, and source permissions still apply.

Data source routing, also GA in August, picks the right lakehouse, warehouse, semantic model or KQL database for each question. Visual responses and data agent MCP tasks followed as GA in September 2026.

Other pieces, however, remain previews. Service principal authentication and Python SDK evaluation were still preview in November 2026. So were Purview controls for agents and integration with the Azure AI Agent Service in Microsoft Foundry.

Teams running both platforms can compare this layer with Snowflake Intelligence, the comparable agent layer on the Snowflake side. The Fabric data agents guide covers build steps.

Operations Agents: AI That Recommends Actions on Live Data

An operations agent is the first Fabric AI layer that moves from answering to acting. Per the operations agent documentation, it monitors real-time data from an eventhouse or an ontology and recommends actions in Teams. It is listed as GA, though trial capacities do not support it.

Identity is the detail that matters most. Each operations agent now has its own Microsoft Entra Agent ID, which makes it a governable identity in Entra. Approved actions, though, still run with the creator’s delegated permissions.

So a sound practice follows: build each operations agent under an account whose rights match the actions it should take, and nothing more.

Fabric IQ and Ontologies: Business Context for Agents

Fabric IQ gives agents a shared business vocabulary, so “active customer” or “late order” means the same thing in every answer. Three parts of it reached GA during 2026. Plan in Fabric IQ arrived in July, while Fabric IQ in Microsoft 365 Copilot and the Fabric IQ MCP Server followed in September.

The Fabric ontology item that defines those business entities is still a preview, and so is using an ontology as context for a data agent. Alongside it, the Fabric Core MCP Server went GA in September 2026. It gives outside agents authenticated, audited access to workspaces, items, permissions, search and capacity information. The Fabric IQ explainer covers how the pieces fit together.

Security and Governance Updates: OneLake Security, Purview and Network Isolation

Security in Fabric decides who can see which rows and columns, where data may travel and who holds the keys. Every AI and real-time feature above sits on these controls. Every AI feature inherits the access these controls grant, so they quietly decide what AI can reach.

For example, consider a bank’s credit team that wants Copilot over loan data. Without row-level rules, any analyst with workspace access could ask about any region’s loans. Once OneLake security roles are in place, the same question returns only the rows that analyst is cleared to see.

OneLake Security: One Role Model Across Engines

OneLake security gives Fabric one role-based model for data access, applied across the engines that read OneLake. Roles grant access only, there are no deny roles, and they support row-level and column-level security. The role management experience, called Members and Data, reached GA in September 2026.

The OneLake security getting-started guide lists limits worth knowing before rollout:

• Spark reads need runtime 1.3, which means Spark 3.5 or later.
• Lakehouses without schemas lack data preview for tables that carry RLS or CLS.
• OneLake security does not work with Azure Data Share.

None of these block adoption, but each one belongs in the rollout plan. The OneLake security deep dive walks through role design.

Purview: DLP Restrict Access and DSPM for AI

Microsoft Purview also adds policy on top of permissions. DLP restrict access reached GA in September 2026. Since then, a Purview data loss prevention policy can limit access to sensitive data in Fabric, not just raise an alert.

DSPM for AI is the newer piece. It watches Fabric Copilots and data agents for sensitive information in prompts and responses, with Audit and eDiscovery support. It was still in preview in November 2026, so treat its signals as an early warning rather than a control of record. The Microsoft Fabric governance guide shows how these policies fit a wider program.

Network and Key Controls

Network controls decide where data may travel, and key controls decide who can read it. Five of them reached GA in August and September 2026:

The eventhouse rows matter especially for anyone streaming regulated data. In many designs, the streaming store used to be the soft spot. Eventhouses now carry the same boundary controls as the lakehouse.

Real-Time Intelligence Updates: From Event to Action

Real-Time Intelligence is Fabric’s set of tools for data that arrives as a stream of events rather than a nightly batch. The 2026 updates matter because they close the gap between seeing an event and doing something about it. If you are new to the workload itself, start with the Real-Time Intelligence overview, since this section covers only what changed.

Consider a cold-chain logistics team. Sensors on refrigerated trucks send temperature readings every few seconds. But the useful outcome is not a chart. It is an alert to the right person, and ideally a recommended action, before the load spoils.

Ingest: New Eventstream Connectors and Secure Transport

Event streaming in Fabric starts with Eventstream, where events enter the platform, and it gained both new sources and safer connections. The MQTT connector reached GA in August 2026 with TLS, mTLS and private network support, which suits device and sensor data. Before that, custom certificate authorities and mTLS for connectors went GA in July 2026.

September 2026 then added GA connectors for Cribl, Solace PubSub+, SAP Datasphere, MongoDB change data capture and the Mirrored Database Change Feed. Streams that once needed custom middleware can now land directly in an eventhouse.

Detect and Act: Activator and Anomaly Detection

Activator is the rules engine that turns a pattern in the data into an action. Two updates make it far more useful. Stateful conditions and actions on Fabric items reached GA in September 2026, and Activator rules inside Eventstream went GA a month earlier.

Stateful conditions are the bigger change. A rule can now react to how a value changes over time, such as a temperature that stays high. It no longer has to fire on every single reading.

Alerts from the anomaly detector reached GA in August 2026, while anomaly detection itself was still a preview in November 2026.

Share and See: Business Events, Real-Time Dashboards and Maps

The final link is getting events in front of people, because an alert nobody sees changes nothing. Real-Time Dashboard reached GA in July 2026, and Business Events followed in September. ArcGIS Maps for Fabric also went GA in September 2026. It helps teams see where an event is happening, not just that it happened.

Put together, the chain runs from ingest through rules and alerts to a dashboard, a map or an operations agent. Each step is GA except anomaly detection, so a team can build the full path on supported features today.

How the Three Update Lanes Depend on Each Other

The three lanes are not independent menus, and that is the main argument of this guide. Each one rests on the one before it, so switching them on out of order creates risk that no single feature page warns about.

In practice, the three lanes stack into four steps, because AI splits into AI that reads and AI that acts. The access model comes first, because OneLake roles decide what any user, and therefore any agent acting for that user, can read. Governance comes second, because Purview policies and outbound rules decide what may leave the boundary once someone can read it.

AI that reads then comes third. Copilot and data agents answer with the asking user’s own access, so they are only as safe as the first two steps. AI that acts comes last, because an operations agent turns live events into actions.

When a step is skipped, the failure is predictable. For example, a data agent over an open lakehouse will answer questions it should refuse. An admin-built operations agent repeats the 2 a.m. problem from the opening scene. Neither problem is a bug in the AI feature; both come from building out of order.

Which Microsoft Fabric AI, Security and Real-Time Intelligence Updates to Adopt Now, Pilot or Wait On

A decision table turns the register into a plan by matching each common situation to a clear pick. “Adopt now” means GA and ready once prerequisites are met. “Pilot” means GA but worth proving on one bounded case first, and “Wait” means preview.

The table answers the question this guide set out to answer, scenario by scenario.

The pattern across rows is consistent. Security and ingestion are adopt-now items in every case, reading AI is a pilot, and preview features wait. Only the order changes the risk.

Worked Example: An Inventory Exception Pilot

Here is how the 2 a.m. scenario from the opening could run as a safe pilot. The distributor is hypothetical, and the steps carry no measured results.

1. Set the access model. Create OneLake security roles so each planner sees only their own warehouses, then run a negative test: a planner tries to read another region and must fail.
2. Stream the events. Land order and stock events in an eventhouse through Eventstream, with mTLS on any external connector.
3. Write one stateful rule. In Activator, alert when projected stock stays below a reorder line for a set period, not on a single dip.
4. Add the agent last. Build the operations agent while signed in as a service account scoped to transfer requests only, never as an administrator. Its Entra Agent ID logs what it does, but its rights come from that account.
5. Keep a human approver. Every recommendation goes to a named planner in Teams, and nothing moves without approval.
6. Agree stop criteria up front. Pause the pilot if the agent recommends a transfer the planner could not have made, or if capacity alerts start to fire.

Each step uses only GA features, and each one is testable on its own before the next begins.

Capacity and Cost Effects of the AI and Real-Time Updates

Capacity is the pool of compute a Fabric tenant pays for, and every update in this guide draws on it. Copilot, data agents and streaming jobs all consume capacity units. Heavy Copilot use can also throttle other work on the same capacity, such as a finance team’s month-end reports.

Capacity overage, GA in September 2026 for Fabric F SKUs, changes that advice. It is on by default for new capacities and pays for eligible excess usage to prevent throttling, up to a rolling 24-hour threshold you configure. So a pilot should set that threshold deliberately, not just watch the metrics.

That makes capacity a design input rather than an afterthought. A pilot should record how much capacity its questions and alerts use before anyone approves a wider rollout. Prices change often, so this guide quotes none; the Fabric pricing guide and the Fabric capacity guide cover the numbers.

Two more 2026 updates also make usage easier to watch:

• The Capacity Metrics app gained GA enhancements in September 2026, including health-state duration, CU-per-second views, heatmaps and chargeback.
• Capacity Overview Events in the Real-Time Hub reached GA in August 2026, bringing capacity events into the same place teams watch their streams.

Chargeback is the quiet win here. When each department sees what its Copilot and agent use costs, the conversation about scaling becomes a budget decision instead of a surprise. Capacity also sits inside wider Microsoft licensing choices, so the two belong in the same plan.

Risks, Governance and Common Mistakes

The risks in this set of updates come less from the features than from how teams switch them on. The same mistakes show up across organizations, and each has a simple fix.

1. Running previews in production. Anomaly detection, ontologies and DSPM for AI can change before GA. Keep them in pilots with a named owner.
2. Letting an administrator build agents. As the opening scene showed, an admin-built agent can act far beyond its purpose.
3. Skipping negative permission tests. Testing that the right person sees the right data is not enough. Test that the wrong person sees nothing.
4. Alerts without owners. An Activator rule that pages nobody in particular gets ignored within weeks.
5. Leaving outbound access open. Outbound access protection is GA for OneLake and eventhouses, so an open boundary is now a choice.
6. Ignoring DSPM signals. Even as a preview, a flag on sensitive data in a prompt is worth a review.
7. Piloting on a trial capacity. Copilot and operations agents do not run on trials, so the pilot proves nothing about production.

Most of these come back to one habit: treat every AI feature as a new user with its own access. Then review what that user can read and do, and test it the same way you would test a new hire’s permissions.

How Kanerika Takes Fabric Updates to Production

Kanerika is a Microsoft Solutions Partner for Data and AI with the Analytics specialization. Our Microsoft Fabric services team takes new releases into client tenants in four stages, mirroring the dependency order above.

1. Release triage. Sort each update into GA or preview, then check it against the client’s tenant settings, region and capacity.
2. Access model. Design OneLake security roles, row-level rules and outbound access rules before any AI feature is switched on.
3. Governed pilot. Pick one business decision, run negative permission tests and keep a human approver on every agent action.
4. Scale and run. Check capacity use from the pilot, review DSPM for AI signals and widen access only where both are clean. Then hold a monthly release review, so previews move into plans only when they reach GA.

Stage two is also where our data governance services do most of their work. It is where Fabric projects most often save time later.

Client Example: Checking Security Before Go-Live

One engagement shows what checking access early looks like. Forest River, a large North American maker of recreational and commercial vehicles, was moving from Dynamics AX to Dynamics 365 Finance and Operations. Microsoft Fabric sat on the critical path, and a third-party integrator had built it.

Kanerika ran a six-week, read-only review of the Fabric workspace, a 124-table Dataverse mirror, pipelines, notebooks and security settings. No system changed during the review. Its RAG scorecard covered five lenses and 18 dimensions and logged about 136 findings, each with an owner and a sequence.

Leadership got a conditional go-live recommendation, with pre-cutover actions scoped at an estimated 30 days. Target states for security, governance and DevOps then gave the platform a path to scale.

The same order matters for the AI lane. A data agent or Copilot inherits whatever access the platform already grants, so gaps found before go-live never reach an AI answer. That is the practical payoff of putting the access model at stage two.

Native Fabric Workloads

Kanerika also builds on Fabric directly. At FabCon 2026 on March 19, 2026, we launched two native Fabric workloads. One is Karl, an AI data insights agent, and the other is the Azure to Fabric Migration Accelerator. Both run as native workloads inside Microsoft Fabric rather than as separate tools beside it.

The Bottom Line

The 2026 updates make Fabric’s AI, security and real-time features production-ready, but not all at once and not in any order. Adopt the security controls and the real-time ingest and alerting features now, since they are GA and everything else depends on them. Pilot Copilot, data agents and operations agents next, with human approval on anything that acts. Hold ontologies, anomaly detection, DSPM for AI and service principal access for data agents on a watch list until they reach GA.

So which Microsoft Fabric AI, security and real-time intelligence updates come first? The ones that decide access, because every AI feature inherits them.

Frequently Asked Questions