Last updated: October 14, 2026
By ZapAI Team
TL;DR: Fabric Real-Time Intelligence is the streaming side of Microsoft Fabric. Eventstream brings events in, Eventhouse stores them for fast KQL queries, Real-Time Dashboards show them, and Activator acts on them. It bills against the same capacity units as the rest of Fabric, so the setting that decides your bill is whether Eventhouse sleeps when idle. Use it for telemetry, logs, and anything you need to react to in seconds, not hours.
Fabric Real-Time Intelligence is Microsoft Fabric’s workload for data in motion. Eventstream ingests and routes events, Eventhouse stores and queries them with KQL, Real-Time Dashboards visualize them, and Activator triggers alerts and actions when conditions hit.
Most data platforms are built around a nightly load. That’s fine for a monthly P&L. It’s useless when a freezer is warming up, a shipment scan hasn’t arrived in six hours, or a production line starts throwing error codes at 2 a.m.
That gap is what Fabric Real-Time Intelligence fills, and buyers have noticed. On Microsoft’s FY25 Q3 earnings call, Satya Nadella said Real-Time Intelligence was the fastest-growing Fabric workload, used by 40% of Fabric customers five months after it went GA. Fast adoption doesn’t mean easy adoption, though. This guide covers what each piece does, what it costs, where it fits next to a lakehouse, and how we approach builds for our Fabric real-time analytics clients.
Bias disclosed. We sell Fabric work. We’ll still tell you when a scheduled refresh is enough.
What Is Fabric Real-Time Intelligence, Piece by Piece?
It’s a set of Fabric items that cover the full event lifecycle, from discovery and ingestion through storage, query, visualization, and automated action. Each piece is a separate item you can use alone or chain together.
Microsoft’s Real-Time Intelligence overview on Learn lists the parts. Here’s the status of each as we read the docs on October 14, 2026.
| Component | What it does | Status |
|---|---|---|
| Real-Time hub | Org-wide catalog of data streams, Microsoft sources, and Fabric and Azure events | Generally available |
| Eventstream | No-code ingestion, filtering, aggregation, and routing from Kafka, Event Hubs, IoT Hub, database CDC, Kinesis, Pub/Sub, and MQTT | Generally available |
| Eventhouse and KQL databases | Time-indexed store for telemetry, logs, and semistructured events, queried with KQL or T-SQL | Generally available |
| Real-Time Dashboards | KQL-driven tiles with live refresh; Copilot tile authoring is preview | Generally available |
| Activator | No-code rules engine that fires emails, Teams messages, pipelines, notebooks, or Power Automate flows | Generally available; some actions preview |
| Anomaly detection | Recommends models and monitors Eventhouse tables for outliers without copying data | Preview |
| Digital twin builder | Low-code modeling of physical assets and sites as an ontology | Preview |
Two of those are preview. Don’t build a go-live date on them. If you want the bigger picture of how these items sit on OneLake next to Spark and the warehouse, our Fabric architecture explainer covers that layer, so we won’t repeat it here.
How Does a Typical Streaming Pipeline Fit Together?
Events land in an Eventstream, get cleaned and routed, settle in an Eventhouse, and feed dashboards and Activator rules. Four hops, all inside one capacity.
A realistic setup for 300 connected machines looks like this. Devices publish to Azure IoT Hub. An Eventstream pulls from IoT Hub, drops malformed messages, rolls readings into one-minute averages, and sends raw events to an Eventhouse while a derived stream carries only the alarms. Activator watches that derived stream. A Real-Time Dashboard sits on the Eventhouse for the operations team.
Now the part people skip. Turn on OneLake availability for the tables your data engineers need, because it’s opt-in for Eventhouse, unlike every other Fabric store. Without it, the lakehouse crowd can’t see the telemetry at all.
Where Does Real-Time Intelligence Pay Off by Industry?
Anywhere the value of a signal decays in minutes. Equipment telemetry, shipment status, store-level sales swings, and security logs are the four patterns we see most.
- Manufacturing plants stream vibration, temperature, and cycle counts, then let anomaly detection flag the spindle that drifts before it fails. Our manufacturing practice usually starts with one line, not the whole plant.
- Logistics. Activator’s absence-of-data (heartbeat) rule can open an investigation when a package hasn’t been scanned in a set window, one of the use cases Microsoft lists itself.
- What about retail? Watch same-store sales by the hour and trigger a promo or a manager alert when a location dips below its usual curve.
- Field service and equipment monitoring, where a reefer unit or freezer crossing a threshold should create work for a technician before the inventory spoils.
- Security and IT teams query firewall, sign-in, and application logs in KQL. Real-Time Dashboards can also read Azure Monitor Log Analytics and Application Insights directly.
One honest caveat. If your stakeholders look at the numbers once a morning, a scheduled lakehouse load costs less and breaks less. Real-time is a cost you pay every hour.
When Should You Use Eventhouse Instead of a Lakehouse or Warehouse?
Use Eventhouse when data arrives as timestamped events and people query recent slices of it interactively. Use a lakehouse for Spark engineering and ML, and a warehouse for modeled, SQL-first BI.
Microsoft’s Fabric data store decision guide draws the same line. Our condensed version follows.
| Question | Eventhouse | Lakehouse | Warehouse |
|---|---|---|---|
| Typical data | Telemetry, logs, JSON events, free text | Files and Delta tables of any shape | Cleaned, modeled tables |
| Main language | KQL, plus T-SQL | PySpark, Spark SQL | T-SQL |
| Freshness | Seconds after ingestion | Batch or micro-batch | Batch |
| Sweet spot | Time-series, trend, and pattern queries over billions of rows | Data engineering and data science | Star schemas, multi-table transactions, finance reporting |
| In OneLake by default? | No, opt-in per database or table | Yes | Yes |
Most real projects use two of these, not one. Hot telemetry lives in Eventhouse for 30 to 90 days, and curated daily aggregates flow to the lakehouse or warehouse for long-term reporting. The question isn’t which store wins. It’s where the handoff happens.
What Does Real-Time Intelligence Cost on a Fabric Capacity?
There’s no separate license. Eventstream, Eventhouse, and Activator all draw capacity units from your F SKU, and storage is billed on top. Eventhouse uptime is usually the biggest line.
Eventhouse bills by UpTime, meaning active seconds multiplied by the virtual cores in use, per Microsoft’s Eventhouse consumption documentation. By default it suspends when idle and takes a few seconds to wake. Capacity Planner mode, which Microsoft used to call Always-on, keeps it running. Per the Capacity Planner guide, the default floor is 2 CUs with 25 GB of cache, you can schedule different floors in 60-minute blocks across the week, and you stop paying for OneLake cache storage while it’s on.
Do the math before you flip it. Azure’s retail price list showed $0.18 per CU hour pay-as-you-go in East US on October 14, 2026. A 2 CU floor running all month is about 1,460 CU hours, roughly $263 at that rate. That’s the entire capacity of an F2. Teams that test on an F2 with Capacity Planner on, then wonder why their notebooks crawl? We’ve watched that happen.
Eventstream is lighter. Its published consumption rates are a 0.222 CU-hour flat charge per active hour, 0.342 CU hours per GB of traffic, and a processor that starts at 0.778 CU hours and autoscales. Nothing bills after two hours with no traffic. Activator charges only while rules are running.
Reservations change the picture. The Fabric pricing page puts 1- or 3-year reservation savings at about 41% against pay-as-you-go. Price it in your region.
How Do You Move Off Azure Data Explorer or Synapse Data Explorer?
Synapse Data Explorer was scheduled for retirement on October 7, 2025, with remaining workloads deleted. Azure Data Explorer is still supported, so you can migrate it or simply query it from Fabric.
For Synapse Data Explorer stragglers, Microsoft’s migration guide describes a preview REST API flow with four steps (validate, migrate, monitor, verify). It moves every database in the cluster into a new Eventhouse and redirects the old endpoints for up to 90 days. It does not carry over Event Hubs or IoT Hub data connections, private endpoints, customer-managed keys, firewall rules, follower clusters, or continuous export. Rebuild those by hand. If you’re past the retirement date and still running, check the cluster status in the Azure portal today.
Azure Data Explorer is a softer decision. A database shortcut makes an ADX database queryable inside Fabric, read-only, with a lag of seconds to minutes. That’s a decent first step while you decide. For the wider Synapse picture, see our Fabric vs Azure Synapse comparison.
How Does It Connect to Dynamics 365 and Power BI?
Dynamics 365 data reaches Fabric through Link to Fabric, and Activator can push actions back through Power Automate. Power BI reads Eventhouse directly for near-live reports.
Link to Fabric gives Dataverse tables, including Dynamics 365 accounts, assets, and cases, a lakehouse replica in OneLake that updates as records change. Join that to telemetry and an alert stops being a device ID. It’s a named customer, a specific asset under contract, and a service level.
Closing the loop is where it gets interesting. An Activator rule fires, a Power Automate flow creates a work order in Dynamics 365 Field Service, and the dispatcher sees it on the schedule board. Our Field Service guide covers that side. On the reporting end, the decision guide calls out fast DirectQuery from Power BI to Eventhouse, and Activator can watch Power BI visuals too. Our Power BI consultants typically pair a live Real-Time Dashboard for operators with a Power BI report for managers.
What Are the Implementation Steps?
Start with one stream, one decision, and one owner. Then size capacity from real numbers, not guesses.
- Pick one decision worth making faster. For example, dispatch a tech when a compressor runs hot for 10 minutes. No decision, no project.
- Inventory the source. Note the protocol (IoT Hub, Kafka, MQTT, CDC), events per second, and payload size.
- Build the Eventstream. Filter junk, aggregate where you can, and send alarms to a derived stream.
- Create the Eventhouse. Set cache and retention policies to how far back people actually query, and turn on OneLake availability where engineers need it.
- Add a Real-Time Dashboard. Use parameters so tiles filter early.
- Write Activator rules. Check Activator’s preview of how frequently each rule would have fired on past data before you switch it on.
- Measure capacity, then decide on Capacity Planner. Two weeks in the Fabric Capacity Metrics app tells you more than any estimate.
Where Do Real-Time Projects Go Wrong?
Oversized ambitions, undersized capacity, and alert spam. Skills trip people up too, since KQL is new to most SQL teams.
Throttling is the scary one. Microsoft describes three levels, and at the extreme level ingestion and queries pause and data can be lost after a holding period. One runaway Spark job on a shared capacity can push a real-time workload there. Put streaming on its own capacity or use workspace-level surge protection.
Alert fatigue is quieter. A rule that fires 400 times a day gets muted by Thursday. Activator’s state-transition logic fires on entry into a condition rather than on every event, which helps, but only if rules are written per object, per sensor, per truck.
And KQL? Easy to read, different enough from T-SQL to slow a team down for a few weeks. Copilot in the queryset helps. It doesn’t replace one person who knows the language.
Wrapping Up
Fabric Real-Time Intelligence works best when one specific decision depends on fresh data. Eventstream and Eventhouse are mature, anomaly detection and digital twin builder are still preview, and cost hinges on Eventhouse uptime. Measure before you commit to always-on.
ZapAI is a Microsoft Dynamics 365, Power Platform, Fabric, and AI consulting firm based in Irving, Texas. We help US companies connect streaming data to the business systems that act on it. If you have one stream and one decision in mind, our real-time analytics team can scope a pilot and a capacity estimate around it.
What Data Teams Ask About Fabric Real-Time Intelligence
Do we need a separate license for Real-Time Intelligence?
There’s no separate license. It runs on any Fabric F capacity and draws from the same capacity units as your other Fabric items. Storage is billed separately.
Eventhouse vs KQL database, which one do I create?
Both, sort of. An Eventhouse is the container that holds one or more KQL databases and shares compute across them. You create the Eventhouse, then databases inside it, and billing shows up on the Eventhouse item.
Will an Eventhouse cost us money when nobody is querying it?
Only if you keep it awake. By default it suspends when idle and wakes in a few seconds. Capacity Planner mode keeps it running at a floor of 2 CUs or more, which suits time-sensitive alerting but bills around the clock. A common middle ground is a higher floor during business hours and none overnight.
Is Azure Data Explorer being retired too?
Not as of October 2026. The retirement applied to Synapse Data Explorer, the preview pools inside Azure Synapse. Azure Data Explorer clusters keep running, and you can query them from Fabric with a database shortcut.
Realistically, how fast can we get a first use case live?
Four to eight weeks for one source, one dashboard, and a handful of Activator rules, assuming the device or app already publishes events. Most of the calendar goes to source access and agreeing what the threshold should be, not to Fabric itself.
Can Activator update Dynamics 365 directly?
Through Power Automate, yes. Activator triggers a flow, and the flow creates or updates Dataverse records, such as a Field Service work order or a Customer Service case. Keep the flow simple and log every run so you can audit what the rule did.