Work IQ A2A is Microsoft's way of letting any external agent securely consume the organizational intelligence inside a Microsoft 365 tenant over the open agent-to-agent protocol. This article explains the architecture, the agent card discovery step, and the delegated permission setup, based on a June 2026 community call demo by Paolo Pialorsi.
What is Work IQ A2A?
Work IQ A2A is the agent-to-agent interface of Work IQ, a Microsoft service that gives agents access to organizational context about people, collaboration, and workflows. Work IQ sits inside the broader Microsoft IQ platform family, and it exposes that context to external agents through three channels: the A2A protocol, MCP, and REST APIs.
Work IQ is generally available, per Microsoft's general availability announcement referenced on the Microsoft IQ series page. The architecture combines chat-based interaction, user context, a set of tools for executing actions, and workspaces that track long-running operations.
This article is based on a demo by Paolo Pialorsi from the Microsoft 365 & Power Platform community call on June 30, 2026, where he connected both a custom single-page application and an agent to the Work IQ A2A server.
Why use the A2A protocol instead of MCP or REST?
A2A is an open standard, led under the Linux Foundation and released as version 1.0 in March 2026, designed for agent-to-agent communication with native natural language support. Per the presenter, Work IQ exposes all three interfaces, and the choice depends on the scenario.
With A2A, a client agent submits a task to a remote agent and can track progress through polling, streaming, or webhooks. The remote agent returns a processed result, not raw data. In the demo, the answer to 'Who am I and what is my role?' came back as an AI-generated response built from tenant content by the LLM behind the Work IQ agent.
The three access channels compare like this:
| Channel | Best for | Interaction style |
|---|---|---|
| A2A | Multi-agent delegation and coordination | Tasks, streaming, webhooks |
| MCP | Tool-style calls from agent frameworks | Model context protocol calls |
| REST APIs | Direct service integration | Standard HTTP requests |
A coordinating agent that delegates work to specialized agents fits A2A naturally. An agent that needs a specific tool call may be better served by MCP, and a traditional backend integration by REST.
How agent discovery works with the agent card
Before any task is exchanged, an A2A consumer performs a handshake that starts with agent discovery. The remote agent publishes an agent card, a JSON document available at the well-known endpoint .well-known/agentcard..
The agent card describes four things: the identity of the agent, its service endpoint, the capabilities it offers, and, where applicable, authentication requirements for consuming it securely. It also lists the skills the agent provides, so a client agent can decide what to delegate before sending a single task.
In the Work IQ case, the consumer fetches the agent card from the A2A endpoint, then uses the card's endpoint and authentication metadata to establish the session. This discovery step is standard A2A behavior, not something Work IQ specific.
Securing Work IQ access with Entra ID and delegated permissions
Work IQ accesses the intelligence of your organization, so security is a requirement, not an option. Access relies on OAuth and Microsoft Entra ID, Microsoft's identity and access platform.
The setup demonstrated on the call follows these steps:
- Register a consumer application in Entra ID, obtaining a client ID and, if needed, a client secret for server-side client-credentials flows.
- Register the Work IQ application in your tenant, following Microsoft's published instructions.
- Add API permissions for Work IQ, selecting the delegated permission
WorkIQAgent.Ask. - Grant admin consent so the application can consume Work IQ under a user's identity.
Delegated permissions matter because, as of the June 2026 demo, Work IQ operates under the identity of a specific user across all three protocols, so the service works in that user's context. For the browser demo, the presenter used the OAuth PKCE flow with no client secret, requesting the scope workiq.service.cloud.microsoft/workiqagent.ask.
The resulting access token carried the Work IQ Agent.Ask scope, which the A2A consumer sample application then used against the A2A endpoint.
Demo 1: a custom A2A consumer application
The first demo used a single-page application the presenter built, in his words vibe coded, with GitHub Copilot. It targets https://workiq.service.cloud.microsoft/a2a and performs the full flow: token acquisition, agent card retrieval, task submission, and streamed response monitoring.
Two prompts showed the range. A simple one, 'Who am I and what is my role?', returned identity, role, and organization details drawn from the tenant. A second, 'Create a Word document with a plan for improving my career', showed task delegation: the client agent continued working while the remote task ran, then retrieved a download link to a Word document generated from HR content stored in the tenant.
The wire-level view confirmed standard A2A mechanics: a request for the agent card, a task creation request carrying the prompt, and streaming updates as the remote Work IQ agent processed the work.
Demo 2: connecting an agent built GitHub Copilot Studio
The second demo replaced the custom app GitHub Copilot Studio](https://www.microsoft.com/microsoft-365-copilot/copilot-studio), Microsoft's low-code agent building tool. GitHub Copilot Studio, the presenter added an agent, chose the A2A connection type, and supplied the same endpoint URL, a name, a description, and manual OAuth authentication settings identical to the ones used in the custom consumer.
He then set the agent instructions to process every user request through the Work IQ sub-agent. A prompt like 'Look into organization knowledge and tell me who I am' triggered the external agent, and the conversation between GitHub Copilot Studio agent and the Work IQ agent produced an answer grounded in tenant content. He noted that real instructions should call the external agent only when needed, rather than always routing through it.
The point of the second demo is portability: because A2A is an open standard, the consumer can be almost any agent technology, with GitHub Copilot, GitHub Copilot Studio, or a hand-rolled client all valid choices.
Frequently asked questions
- Which permissions does Work IQ require for A2A access? The demo granted the delegated permission
WorkIQAgent.Askto an application registered in Entra ID. Work IQ currently operates under a specific user's identity, so delegated rather than application permissions are used, per the June 2026 presenter. - Where is the Work IQ A2A endpoint? The presenter used
https://workiq.service.cloud.microsoft/a2a, with the agent card at.well-known/agentcard.on that host. - Can agents built outside Microsoft stacks consume Work IQ? Yes. A2A is an open standard under the Linux Foundation, so any agent capable of OAuth and A2A task exchange can connect, using A2A, MCP, or the REST APIs.
- What kind of answers does the Work IQ agent return? Processed, AI-generated responses based on tenant content, not raw data. The demo produced both identity answers and a Word document generated from HR files.
- Is Work IQ generally available? Yes. Microsoft announced general availability of Work IQ, and the technical announcement is linked from the Microsoft IQ series page.
From video demos to written knowledge
A 17-minute community call demo like this one packs a lot of detail: endpoint URLs, permission names, two end-to-end scenarios. Readers who find it useful often prefer it as a searchable, linkable article, the way community contributors from Gustavo dev doido to enterprise architects share knowledge.
If you have recordings like this sitting on YouTube, Skala Blog turns them into structured written articles: paste the video URL, get a transcription, and generate a publishable piece that preserves the demo's details.
Fork this article
Start a new branch from the same video, shaped your way. You keep the credit; the original keeps the attribution.
A fork in another language is filed as a translation of this article, so the two pages point at each other. You can unlink it later from the editor.
0/240
You are creating
- Format
- For
- Language
- Source
- Your angle
You will be asked to sign in before it is generated.
Buy credits