Three doors out of Fabric

What changed at FabCon Europe 2026

Before Barcelona, AI lived inside Fabric. Copilot answered in the report, and the data agent answered in the workspace. You asked in Fabric, and the answer stayed in Fabric. AI was an add-on, not a way out of the platform.

In Barcelona, Microsoft opened the ring. Microsoft 365 Copilot Chat, MCP clients, and Foundry now query Fabric from outside. The data flows the other way: out of Fabric, into tools the Fabric admin does not configure. Your permissions, workspaces, and semantic models all stay. What changes is who asks for the data.

The three doors and the demos behind them

Each door enforces the permissions of the user who asks. That sounds safe, and it is, as long as those permissions were set for a world where people open reports. An agent reads on the user's behalf, so it cannot see more than the user. It can see everything the user can.

Door 1: Microsoft 365 Copilot Chat and Cowork

Fabric IQ in Microsoft 365 Copilot Chat and Cowork is GA. A business user asks in Copilot Chat and gets an answer from a Power BI semantic model you control. There is no extra charge for AI tokens, but the queries still use your capacity, and each user needs a Microsoft 365 Copilot license. The series has no recording of this door, because the demo tenant has no such license. The two settings that open it are in part 1 and part 2.

Door 2: MCP servers

The second door serves developer tools and agents, not people. The Fabric IQ MCP server is read-only: search, metadata, and DAX queries under the signed-in user's permissions. The Fabric Core MCP server turns Fabric REST operations into tools, and many of those tools write changes to workspaces, items, and permissions. Tenant-wide search is one of its tools, and the same search is a REST API in part 7.

Door 3: Copilot Studio and the OneLake Table Read API

A Copilot Studio agent can use a Fabric data agent as a tool. Apps can read Delta and Iceberg tables over REST with the OneLake Table Read API, and OneLake security filters rows and columns on every request. Outside engines reach the same tables with no copy through Unity Catalog and Iceberg REST catalog endpoints. The Copilot Studio path has no recording here, for the same license reason as door 1.

Two settings Microsoft turned on for you

Two settings control agent access to Fabric data, and both are on by default in every tenant. “Fabric data in Microsoft Copilot” in the Microsoft 365 admin center decides which users can reach Fabric data from Microsoft 365 Copilot. The AI setting on each semantic model lets anyone with read access use Copilot, the data agent, and Microsoft's MCP tools on that model. Chained models do not inherit it, so each model in a chain needs its own check.

In the talk, Dr. Kot asked the room who had checked both in their tenant. Start there. Part 1 covers the tenant switch, and part 2 covers the model setting.

Agents that work inside Fabric

The doors let agents read. A second group of announcements lets agents do work inside Fabric. Each one runs as a user and stops where that user's permissions stop.

• Project Osmos, the data engineering agent, plans, runs, and validates a task on SparkCore, started from a coding agent in the terminal.
• The operations agent investigates a failed pipeline run from Monitor hub, read-only, as the signed-in user.
• The ontology in Fabric IQ turns semantic models, OneLake data, and documents into business entities, metrics, and rules that agents read as context. It does not run the rules.
• Copilot for Real-Time Intelligence builds a Real-Time Dashboard on an eventhouse from one sentence.
• The Fabric data agent answers plain-language questions with SQL, DAX, or KQL over your data sources.

Who walks through the doors

If every door enforces the user's permissions, the permission model is the real control. Four demos cover it.

• OneLake security defines roles, row-level security, and column-level security once and enforces them across Fabric engines and shortcuts.
• Outbound access protection stops data from leaving a workspace through shortcuts and data agents.
• Policies in Fabric set an allow list for the tenant or a capacity. Allow is the only effect.
• OneLake catalog Govern puts label coverage, DLP results, tenant settings, and recommended actions on one admin screen.

Building blocks that are already GA

Not every demo is about agents. Two capabilities shown in the talk's appendix are GA and useful on any Fabric project today. AI functions in Spark translate, classify, and score sentiment on a DataFrame column in one line, on a built-in endpoint. Materialized lake views build silver and gold layers in SQL, with constraints that drop bad rows.

Turn on, pilot first, put off

Preview is not production. In the talk, the label decided the recommendation, not opinion. The board below is the one Dr. Kot showed on October 21, 2026. Each part of the series carries the status as of November 3, 2026, so check the part before you act on a column.

What is still missing

Six items had no date or no price on October 21, 2026. Check each one again before you plan on it.

No pricing means no F0 in a budget. For R5, Learn moved on November 3, 2026: it labels OneLake security GA in Fabric engines and preview for third-party engines and the Table Read API. It still gives no GA date. Part 13 has the details.

All 18 demos

Every part shows one recording, explains the mechanism, names the catch, and ends with one thing to do on Monday. The labels below are the statuses published in each part.

Defaults to check Monday

1. 01 “Fabric data in Microsoft Copilot” is on for everyone GA

   A Microsoft 365 admin center setting decides who can ask Copilot about Power BI data, and it ships set to All users. Four gates, three owners, and the Monday check.

2. 02 One AI toggle on every semantic model GA

   Each semantic model has a switch that opens it to Copilot, data agents, and Microsoft MCP tools for read-only users. It starts on, and models built on it do not inherit it.

MCP servers

1. 03 Fabric IQ MCP server: query a semantic model from your coding agent GA

   Fabric IQ MCP is GA: six read-only tools let a coding agent find a semantic model and run DAX as you. Your agent writes the DAX, and users can grant consent themselves by default.

2. 04 Fabric Core MCP server: 43 tools, 25 of them write GA

   Fabric Core MCP is GA, and Learn's tools reference lists 43 tools, 25 of them write, including delete_workspace and OneLake role replacement. Where the safeguards sit, and Learn's warning quoted.

Reading Fabric data from outside Fabric

1. 05 OneLake Table Read API: REST reads that respect row security Preview

   The OneLake Table Read API returns Fabric table rows as Apache Arrow over REST, with OneLake RLS and CLS applied on the server. Preview. The request path, six caller outcomes, and the cost catch.

2. 06 Unity Catalog and Iceberg REST on OneLake: one table, no copy GA

   OneLake serves the same Delta tables through the Iceberg REST Catalog and a Unity Catalog compatible API, with no copy. Why OneLake security blocks instead of filtering there, and which door to use.

3. 07 OneLake catalog search API: find any item in the tenant from code Preview

   One POST to /v1/catalog/search finds Fabric items across every workspace you can access, and Fabric Core MCP runs the same search. Preview. Two permission gates, and what search exposes.

Agents

1. 08 Project Osmos: a data engineering agent that plans, runs, and checks Preview

   The Fabric data engineering agent turns one outcome into notebooks and a validated Delta table on SparkCore, as you. The eight-setting card, the permission wall, and the catches.

2. 09 Operations agent: root cause for a failed pipeline in Monitor hub Preview

   Select Investigate on a failed pipeline run and the operations agent explains the root cause, read-only and as you. It needs workspace monitoring on before the failure.

3. 10 Ontology in Fabric IQ: business rules an agent can read, not run Preview

   The ontology agent drafts entities, relationships, and metrics from a semantic model and writes only in Act mode. Rules are context, not enforcement. Old ontology retires Jan 31, 2027.

4. 11 Copilot for Real-Time Intelligence: a dashboard from one sentence Preview

   Copilot turns one sentence into a twelve-tile Real-Time Dashboard on an eventhouse. Preview. What it generates, and the four things to review before you share it.

5. 12 Fabric data agent: plain-language questions over a lakehouse GA

   The Fabric data agent turns English questions into read-only SQL that runs as you. Grounding, the English-only limit, and how it reaches Microsoft 365 Copilot and Copilot Studio.

Security and governance

1. 13 OneLake security: define RLS and CLS once, enforce them everywhere GA Fabric engines Preview third-party engines

   OneLake security roles define RLS and CLS once, and every Fabric engine enforces them, shortcuts included. Who they restrict, and why DefaultReader must change first.

2. 14 Outbound access protection: stop data leaving through shortcuts and agents GA shortcuts Preview data agents

   Workspace outbound access protection blocks every outbound connection from a Fabric workspace. What it covers (GA for shortcuts, preview for data agents), what it misses, and what it breaks.

3. 15 Policies in Fabric: an allow list with no Deny Preview

   Fabric policies, in preview, allow an action when a rule matches and block everything else, at tenant or capacity scope. How rules evaluate, and why the first rule changes the default.

4. 16 OneLake catalog Govern: one screen for labels, DLP, and settings GA

   The OneLake catalog Govern tab shows label coverage, DLP results, and recommended actions, refreshed once a day. What it covers, what it misses, and how to turn its cards into a backlog.

Engineering building blocks

1. 17 AI functions in Spark: translate, classify, and score sentiment in one line GA pandas and PySpark Preview multimodal and T-SQL

   ai.translate, ai.analyze_sentiment, and ai.classify on a Fabric DataFrame column through a built-in endpoint with no API key: runtimes, cost per token, regions, and when to bring your own model.

2. 18 Materialized lake views: a medallion in SQL with drop-on-mismatch rules GA Spark SQL Preview PySpark-authored

   Silver and gold as CREATE MATERIALIZED LAKE VIEW statements with CHECK rules: DROP versus FAIL, lineage, incremental refresh, and a demo where three bad rows never reach gold.

How this series was made

Every demo ran in one test tenant with synthetic data, on an F8 capacity in France Central. The public recap repository rebuilds that environment with one script, and each demo has a runbook with the exact prompts in English, Polish, and German. The slides are online in three languages under CC BY 4.0.

Statuses were checked on Microsoft Learn on October 21, 2026, for the talk, and again on November 3, 2026, for these posts. Where the keynote and Learn disagree, the label is TBC. Keynote claims are marked as keynote claims.

Four announcements have no demo. Fabric IQ in Microsoft 365 Copilot Chat and the data agent in Copilot Studio need licenses the demo tenant does not have. Database agents and agentic apps in Power BI Desktop had not shipped.

Frequently asked questions

When and where was FabCon Europe 2026?

FabCon Europe 2026 ran in Barcelona from September 28 to October 1, 2026, together with SQLCon. The keynote, “The Data Foundation for AI,” was on September 29, 2026.

What was announced at FabCon Europe 2026 for Microsoft Fabric?

The keynote opened Fabric data to agents. The main announcements were Fabric IQ in Microsoft 365 Copilot Chat and Cowork, the Fabric IQ and Fabric Core MCP servers, data agents in Copilot Studio, the OneLake Table Read API, Project Osmos, operations agents, a new ontology in Fabric IQ, OneLake security, policies in Fabric, and OneLake catalog Govern. Many of them shipped as preview.

Which Fabric settings should an admin check after FabCon Europe 2026?

Four. Check who can reach Fabric data from Microsoft 365 Copilot in the Microsoft 365 admin center. Review the AI setting on semantic models with HR and finance data. Check the tenant settings that let AI process data outside the capacity's region. Turn on outbound access protection for workspaces with sensitive data.

Is everything announced at FabCon Europe 2026 ready for production?

No. Much of it is preview, which means no SLA. Turn on what is GA, pilot preview features on one workspace, one model, or one capacity, and keep them off a project's critical path.

Can I run these Fabric demos in my own tenant?

Yes. The public recap repository has a Python script that creates an F8 capacity, a workspace, synthetic data, a semantic model, an eventhouse, notebooks, and a data agent. Each demo has a runbook with the exact prompts and expected results. Pause the capacity when you are done.

How current are the statuses in this series?

Each status was checked on Microsoft Learn on November 3, 2026, and every part shows that date in its header. Microsoft relabels Fabric features often, so open the Learn link in a part's sources before you rely on its label.

Sources

Microsoft Learn and the Microsoft Azure blog, checked on November 3, 2026. Each part lists its own sources.

• Microsoft Azure blog: FabCon and SQLCon 2026 in Barcelona, building the data foundation for Microsoft Copilot and agents
• Use Power BI data in Microsoft 365 Copilot
• Copilot and semantic models
• Fabric IQ MCP server
• Fabric Core MCP server overview
• Use a Fabric data agent in Microsoft Copilot Studio
• Read OneLake table data with the REST API
• Copilot and Azure OpenAI tenant settings
• Workspace outbound access protection for data agents
• FabCon Europe 2026 recap: slides, recordings, and runbooks (CC BY 4.0, code under MIT)