Work IQ - Tenant Administrator Enablement Guide

April 3, 2026 · View on GitHub

This guide provides step-by-step instructions for Microsoft 365 tenant administrators to enable Work IQ for their organization.

Quick Start (For Admins with Copilot Licenses)

If your organization already has Microsoft 365 Copilot licenses, you can enable Work IQ in minutes:

Open this URL in your browser (replace {your-tenant-id} with your tenant ID or domain):

https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=ba081686-5d24-4bc6-a0d6-d034ecffed87

Sign in with your admin account
Click Accept to grant consent for your entire organization

That's it! Users with Copilot licenses can now install and use Work IQ. See the Work IQ README for end-user installation instructions.

⚠️ Known Issue – "Access Denied" on Quick Start URL

The Quick Start URL above may fail with an Access Denied or AADSTS650052 error in some tenants. This happens because the Work IQ CLI app registration includes permissions that target the Work IQ Tools MCP Server resource, and the service principal for that resource is not automatically provisioned in your tenant.

Diagnose (optional): You can run the read-only verification script to see what's missing before making changes:
.\scripts\Verify-WorkIQTenant.ps1
Fix: Run the Enable-WorkIQToolsForTenant.ps1 script to provision the missing service principals and grant admin consent in one step:
# Prerequisites: Install-Module Microsoft.Graph -Scope CurrentUser
.\scripts\Enable-WorkIQToolsForTenant.ps1
The script requires the Microsoft.Graph PowerShell modules (auto-installed if missing) and one of: Global Admin, Cloud Application Admin, or Application Admin role. It will:

Create all MCP Server service principals in your tenant (Work IQ Tools, Mail, Calendar, Teams, OneDrive, SharePoint, Word, Admin, Me, M365 Copilot)

Create or verify the Work IQ CLI service principal

Grant admin consent for all required Microsoft Graph permissions

Grant admin consent for all MCP Server permissions

Quick Start
Overview
Prerequisites
Step 1: Verify Microsoft 365 Copilot Licensing
Step 2: Configure Microsoft 365 Copilot in Your Tenant
Step 3: Grant Admin Consent (Alternative Methods)
Step 4: Configure User Access
Troubleshooting
Security Considerations

Overview

Work IQ uses the Microsoft 365 Copilot Chat API as its backend. This API requires specific delegated permissions that need administrative consent before users in your organization can use Work IQ.

Required API Permissions

Work IQ requires the following delegated permissions (all are required):

Permission	Description
`Sites.Read.All`	Read items in all site collections
`Mail.Read`	Read user mail
`People.Read.All`	Read all users' relevant people lists
`OnlineMeetingTranscript.Read.All`	Read all transcripts of online meetings
`Chat.Read`	Read user chat messages
`ChannelMessage.Read.All`	Read all channel messages
`ExternalItem.Read.All`	Read external items

Prerequisites

Before enabling Work IQ, ensure you have:

Required Admin Roles

You need one of the following roles in Microsoft Entra ID:

Role	Capabilities
Global Administrator	Full tenant administration
Privileged Role Administrator	Can grant consent for apps requesting any permission
Cloud Application Administrator	Can grant consent for permissions (except Microsoft Graph app roles)
Application Administrator	Can grant consent for permissions (except Microsoft Graph app roles)

Required Licenses

Microsoft 365 Copilot license for each user who will use Work IQ
Appropriate Microsoft 365 base license (E3, E5, Business Premium, etc.)

Technical Requirements

Access to Microsoft Entra admin center (https://entra.microsoft.com)
Access to Microsoft 365 admin center (https://admin.microsoft.com)

Step 1: Verify Microsoft 365 Copilot Licensing

Work IQ relies on the Microsoft 365 Copilot Chat API, which requires Microsoft 365 Copilot licenses.

1.1 Check Current License Availability

Sign in to the Microsoft 365 admin center at https://admin.microsoft.com
Navigate to Billing > Licenses
Look for Microsoft 365 Copilot in the license list
Verify you have sufficient licenses for your intended users

1.2 Purchase Licenses (If Needed)

If you don't have Microsoft 365 Copilot licenses:

Go to Billing > Purchase services or visit the Microsoft 365 Admin Center Marketplace
Search for Microsoft 365 Copilot
Complete the purchase process

Note: For Education tenants, look for licenses under Microsoft 365 A3 Extra Features for faculty or Microsoft 365 A5 Extra Features for faculty.

1.3 Assign Licenses to Users

Navigate to Users > Active users
Select the users who will use Work IQ
Click Manage product licenses
Assign the Microsoft 365 Copilot license
Click Save changes

Note: Copilot features may take up to 24 hours to appear after license assignment.

Step 2: Configure Microsoft 365 Copilot in Your Tenant

Before users can use Work IQ, ensure Microsoft 365 Copilot is properly configured in your tenant.

2.1 Enable Required Security Measures

Enable Multifactor Authentication (MFA)
- Go to Microsoft Entra admin center > Protection > Conditional Access
- Ensure MFA is enabled for all users
Enable Audit Logging
- Go to Microsoft Purview portal (https://purview.microsoft.com)
- Enable unified audit logging
- Configure appropriate retention policies

2.2 Configure Update Channels

In the Microsoft 365 admin center, go to Settings > Org settings
Navigate to Services > Office installation options
Ensure your organization uses a supported update channel:
- Current Channel (Recommended)
- Monthly Enterprise Channel
- Current Channel (Preview)

Important: Semi-Annual Enterprise Channel is NOT supported for Copilot.

2.3 Configure Copilot Settings

In the Microsoft 365 admin center, navigate to Copilot
Review and configure:
- Data security and compliance controls
- Plugin and extension permissions
- Web data grounding settings (if applicable)

If you haven't used the Quick Start method, here are alternative ways to grant admin consent.

When a user first tries to use Work IQ:

They will see a consent prompt indicating admin approval is required
The application will automatically be registered in your tenant
Follow these steps to grant consent:
- Go to Microsoft Entra admin center at https://entra.microsoft.com
- Navigate to Identity > Applications > Enterprise applications
- Find the Work IQ CLI application in the list
- Select Permissions under Security
- Review all requested permissions
- Click Grant admin consent for [Your Organization]
- Click Accept

If your tenant has admin consent workflow enabled:

Sign in to the Microsoft Entra admin center at https://entra.microsoft.com
Navigate to Identity > Applications > Admin consent requests
Look for pending requests related to Work IQ
Review the requested permissions
Click Review permissions and consent
Click Accept to grant tenant-wide consent

For administrators who prefer scripted deployment.

Prerequisites: Install the Microsoft Graph PowerShell SDK if not already installed:

# Install Microsoft Graph PowerShell module (run as Administrator)
Install-Module Microsoft.Graph -Scope CurrentUser

# Or update if already installed
Update-Module Microsoft.Graph

Grant admin consent:

# Connect to Microsoft Graph with required scopes
Connect-MgGraph -Scopes "Application.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All"

# Get the Work IQ service principal (after a user has attempted sign-in)
$workIqApp = Get-MgServicePrincipal -Filter "displayName eq 'Work IQ CLI'"

# Get Microsoft Graph service principal
$graphSp = Get-MgServicePrincipal -Filter "displayName eq 'Microsoft Graph'"

# Define the required permissions scope
$requiredScopes = "Sites.Read.All Mail.Read People.Read.All OnlineMeetingTranscript.Read.All Chat.Read ChannelMessage.Read.All ExternalItem.Read.All"

# Create the permission grant
$params = @{
    ClientId = $workIqApp.Id
    ConsentType = "AllPrincipals"
    ResourceId = $graphSp.Id
    Scope = $requiredScopes
}

New-MgOauth2PermissionGrant -BodyParameter $params

# Verify the grant was successful
Get-MgOauth2PermissionGrant -Filter "clientId eq '$($workIqApp.Id)'"

Step 4: Configure User Access

4.1 Verify Application Access

After granting admin consent:

Go to Microsoft Entra admin center > Enterprise applications
Find and select the Work IQ CLI application
Go to Users and groups
By default, all users with Copilot licenses can access the application

4.2 Restrict Access (Optional)

If you want to limit which users can use Work IQ:

In the Work IQ CLI enterprise application, go to Properties
Set Assignment required? to Yes
Go to Users and groups
Click + Add user/group
Select the users or groups that should have access
Click Assign

4.3 Configure Conditional Access (Recommended)

For additional security, create a Conditional Access policy:

Go to Microsoft Entra admin center > Protection > Conditional Access
Create a new policy
Configure:
- Users: All users or specific groups
- Target resources: Select Work IQ application
- Conditions: Configure as needed (location, device, etc.)
- Grant: Require MFA, compliant device, or other controls

Troubleshooting

Common Issues and Solutions

Issue	Cause	Solution
"Access denied" / AADSTS error on consent URL	Work IQ Tools service principal not provisioned in tenant	Run `Enable-WorkIQToolsForTenant.ps1` — see Known Issue
Work IQ not visible in Enterprise Applications	Service principal not yet provisioned	Run `Enable-WorkIQToolsForTenant.ps1` to provision it
"Admin approval required" prompt	Admin consent not granted	Use the Quick Start URL or Step 3 methods
"Insufficient permissions" error	Missing API permissions	Verify all 7 required permissions are consented
Users can't sign in	Conditional Access blocking	Review Conditional Access policies
"License required" error	User lacks Copilot license	Assign Microsoft 365 Copilot license to user
Features not appearing	License propagation delay	Wait up to 24 hours after license assignment

Run the verification script to check all service principals and permission grants:

.\scripts\Verify-WorkIQTenant.ps1

Or verify manually:

Go to Microsoft Entra admin center > Enterprise applications
Find the Work IQ CLI application
Select Permissions
Verify all permissions show "Granted for [Your Organization]"

Check User License Assignment

Go to Microsoft 365 admin center > Users > Active users
Select the user
Verify Microsoft 365 Copilot is listed under assigned licenses

Security Considerations

Data Access

Work IQ provides access to sensitive organizational data including:

Email content
Meeting transcripts
Teams messages
SharePoint/OneDrive documents
Contact information

Recommendations

Principle of Least Privilege
- Only enable Work IQ for users who need it
- Use assignment-required settings to control access
Monitor Usage
- Review audit logs for Work IQ activity
- Use Microsoft Defender for Cloud Apps for additional monitoring
Data Loss Prevention
- Ensure DLP policies are in place
- Configure sensitivity labels for classified content
Regular Review
- Periodically audit who has access to Work IQ
- Review consent grants in Enterprise applications

Compliance Notes

Work IQ respects your organization's access controls during conversations
Data accessed through Work IQ is subject to your existing compliance policies
The Chat API is currently in beta; review Microsoft's terms for production use limitations

Additional Resources

Document Version: 1.4 Last Updated: March 2026