What you need

Every route needs:

• Work IQ enabled in your tenant. See Enable your tenant for Work IQ.
• A usage-based billing plan, with each user assigned to it. See usage-based billing.

A tenant admin sets both up once; Authentication has the steps.

By route

Route	Sign-in	Admin, once	Model
MCP, local	The Work IQ CLI’s own registration. Accept its EULA once. Work IQ CLI	Admin consent for the Work IQ application. CLI prerequisites	Yours, with tool calling.
MCP, remote	The published MCP client, or your own registration. MCP overview	Admin consent for your client ID; for the published client, tbd. Grant admin consent	Yours, with tool calling.
A2A	Your app registration: a public client with delegated WorkIQAgent.Ask. Register the app	Admin consent for WorkIQAgent.Ask, which requires it. Permissions reference	None: Microsoft 365 Copilot, or the agent you name, answers. Agent discovery
REST API	Your app registration: the same public client as for A2A.	Admin consent for WorkIQAgent.Ask, as for A2A.	None: Microsoft 365 Copilot answers. REST API overview

The model for both MCP routes is Azure OpenAI, a Microsoft Foundry model or any OpenAI-compatible endpoint, reached with Microsoft Entra ID or an API key. See the Azure OpenAI v1 API, keyless authentication, and Connect settings for what to enter.