1. What Web IQ retrieves and when to use it

Use Web IQ when an application needs public-web evidence: product documentation, public announcements, news or a user-selected page. Results provide titles, URLs, content and available provenance/timestamp metadata. Your model or orchestrator produces the final answer.

Passage retrieval can reduce unnecessary context, but not every response is only a passage. Web/News support query-targeted passages; full-document formats require additional access. Browse extracts a specific URL and does not support passage format because it has no query to target. Images/Video return their own metadata rather than ordinary page passages.

Web IQ is model-agnostic and supports REST, MCP and SDK integrations. MCP compatibility still requires a client that handles the supported protocol/authentication; it does not eliminate application configuration or content validation.

Do not send confidential records to Web IQ because a public question contains them. Use Fabric IQ for governed business data/context and the appropriate Work IQ or Foundry IQ path for other organizational knowledge. Applications do not inherently need every IQ service.

Microsoft reference: Web IQ overview and access model.

2. Create the resource and distinguish the three IDs

The old waitlist-only description is obsolete. Microsoft provides a production onboarding path. Web IQ requires a paid Azure subscription; Azure credits do not work for this service. Do not create a billable resource merely to browse the documentation.

1. In an approved paid Azure subscription, create a Microsoft Web IQ resource, choose its resource group/name and review the Terms of Use.
2. Sign into the Web IQ portal with the account for that subscription. Select the same subscription and resource, then finish the connection.
3. Confirm the resulting Web IQ AppID and its enabled APIs/quota.
4. Use the portal Playground for a public, non-sensitive first request. A successful response proves this resource/AppID connection, not permission for every API or content format.

Default production quota is 15 queries per second per AppID. Check the portal and request higher limits through support if justified; multiple API keys are not a quota multiplier.

Microsoft reference: Azure portal onboarding and AppID.

3. Make one explicit, bounded Web Search request

For the first test, use Playground or the documented REST endpoint POST https://api.microsoft.ai/v3/search/web. Keep credentials in the backend/secret manager. The following is the JSON body only; it contains no credential:

{
  "query": "Microsoft Fabric ontology preview official documentation",
  "maxResults": 5,
  "language": "en",
  "region": "US",
  "contentFormat": "passage",
  "maxLength": 3000
}

Send Content-Type: application/json and the supported authentication header. Query length is limited to 1,000 characters; maxResults supports up to 50. Set format and length explicitly instead of depending on entitlement-specific defaults.

The response uses webResults with fields such as title, url and content; Web Search does not return the older assumed snippet field. Timestamp fields are optional. lastUpdatedAt is the publisher’s content update date, not proof of the service’s last crawl time.

Without full-document access, passage content is limited to 3,000 characters per result even if a larger maxLength is requested. Full text/HTML/Markdown needs the relevant entitlement; a 403 format error should not be disguised as an empty search result.

Acceptance checks: a successful response with inspectable result structure; source URL/title attached to each used passage; only claims supported by the selected evidence in the generated answer; and explicit uncertainty when evidence conflicts or is missing. This walkthrough has not called a paid Web IQ endpoint.

Microsoft reference: Web Search request/response contract.

4. Authentication, quota and common errors

API keys use the x-apikey header. Microsoft warns that keys grant broad account access; do not put them in browser code, screenshots, source control or chat.

For production, Microsoft recommends Entra app-only OAuth. Bind the Entra application client ID to the intended Web IQ AppID and request the documented https://api.microsoft.ai/.default scope. Managed Identity/AgentID can be used under the currently documented identity-binding support; their client IDs must be bound too.

• If one Entra identity is bound to several AppIDs, include the intended APPID query parameter. A missing selection can return 400; an unbound AppID can return 403.
• For API-key authentication, do not include APPID. Each key is already associated with one AppID; the current documentation says adding the parameter produces an authentication failure.
• Azure RBAC governs resource administration, not Web IQ’s API request authorization. AppID binding/entitlement controls the data-plane request.
• Handle rate limiting with bounded retries/backoff and a clear failure path. Do not retry malformed requests, invalid credentials or denied entitlements indefinitely.

Record status, latency and trace ID for diagnosis without logging keys or complete sensitive queries/responses. Resolve subscription/tenant mismatches in portal onboarding before rotating unrelated credentials.

Microsoft reference: Authentication and APPID selection.

5. Current API prices and a transparent cost example

Microsoft’s pricing page lists the following GA endpoint prices effective 16 October 2026, in USD per 1,000 API calls:

The pricing page says Auto is not charged while in beta. Do not extend that to other endpoints or assume beta access is automatic.

For illustration, 10,000 Web calls = $70 and 2,000 Browse calls = $2: $72 for those listed API calls alone. If 1,000 user questions each trigger three Web searches, that is 3,000 calls, or $21, not $7. Model tokens, application hosting, other services, taxes and applicable contractual/content-tier terms are separate.

Use bounded retrieval steps, explicit passage budgets and a maximum number of calls per task. A low-latency service can still produce an expensive agent loop. Do not rely on caching response content as a cost shortcut: the terms constrain storage and derivative datasets.

Microsoft reference: GA endpoint pricing effective 16 October 2026.

6. Public networking, privacy and content-use terms

There is no current guarantee of region-specific processing/residency or EU Data Boundary coverage. The FAQ states that the service is excluded from the Microsoft Products and Services Data Protection Addendum and that the applicable Web IQ terms/privacy framework must be reviewed. Do not assume ordinary Azure-resource compliance promises apply automatically.

Query text is normally logged. Zero Query Logging is a reviewed, individually approved request, not a self-service switch. Web IQ does not automatically detect or mask personal data in inbound queries: remove sensitive content before it leaves your environment.

An API gateway in your own tenant can provide your application’s controls and operational telemetry, but it does not turn the external service into a private endpoint or grant extra content rights. The FAQ says response content must not be cached/stored to build a derivative dataset. Review current terms with the responsible owner rather than creating a permanent crawl/evidence archive by default.

Retrieved content is untrusted. Keep it separate from system/developer instructions, validate output/citations and restrict downstream tools. Index normalization and safety screening do not guarantee removal of prompt-injection text.

Microsoft reference: FAQ: networking, privacy, query logging, evidence and terms.

7. Benchmarks, freshness and publisher discoverability

Microsoft publishes a 164-ms P95 latency figure and grounding-quality/token-efficiency comparisons. Those are vendor benchmark results under specified conditions, not an SLA for your endpoint, a sum-of-P95 calculation for a multi-step agent or proof of superiority on every query. Measure end-to-end latency and evidence quality on your own representative public questions.

Use the format/result limits to match the task. Search returns query-relevant evidence; Browse fetches a selected URL. Multi-step retrieval does not imply the server remembers every prior conversation: carry required context in the orchestrator and follow the chosen API contract. Do not promise stateful follow-up behavior without documented support.

Good evaluation cases include a current official announcement, an obscure fact, a conflicting-source question and a question with no reliable evidence. Check whether citations actually support the stated facts and whether optional timestamps are interpreted correctly. More returned text is not automatically better grounding.

For a publisher, use ordinary discoverability controls: an accurate sitemap, IndexNow where appropriate, Bing Webmaster Tools and a deliberate robots policy. Web IQ has no separate site-submission path. Supported publisher controls matter, but a self-contained paragraph or high traditional search ranking does not guarantee inclusion or citation.

Use Fabric IQ for the business-data side and Rayfin for a related application-development workflow. An integration must still satisfy each service’s independent permission, privacy and billing requirements.

Microsoft reference: FAQ: networking, privacy, query logging, evidence and terms.

Common questions

Official references and review scope

Checked against the following official vendor documentation on 2026-10-30. This is an independent learning guide, not a Microsoft certification, benchmark or customer deployment report. These workflows have not been executed in your tenant. Expected values are teaching acceptance checks; validate feature availability, identity, network, schema, data handling and recovery requirements before production use.

• Web IQ overview and access model
• Azure portal onboarding and AppID
• Authentication and APPID selection
• Web Search request/response contract
• GA endpoint pricing effective 16 October 2026
• FAQ: networking, privacy, query logging, evidence and terms

Take the next practical step

Practice Fabric interview scenarios