In Short: From Watching Dashboards to Being Told
Most analytics answers "what happened". Fabric's Real-Time Intelligence workload answers "what is happening", and Activator closes the loop by acting on it: watch a condition in the stream, fire an alert or an automation the moment it holds. Add AI - anomaly detection that learns normal instead of relying on fixed thresholds, models scoring events on arrival - and the result is an operations layer where the first responder is software.
The shift is bigger than latency. A dashboard requires someone to be looking; an Activator rule does not. For the class of problems where minutes matter - equipment drift, funnel collapse, fraud patterns, delivery exceptions - that difference is the value.
The Stack in One Pass
- Eventstreams ingest from IoT hubs, event hubs, Kafka-style sources and applications, with light transformation on the way through
- Eventhouses (KQL databases) store the events and answer queries over very large volumes at interactive speed
- Real-time dashboards give operations teams the live picture
- Activator watches conditions over the stream and fires actions: Teams messages, emails, Power Automate flows, Fabric pipeline runs
Everything lands in OneLake and consumes capacity like the rest of Fabric, so the streaming estate is not a separate platform with separate governance; it is another workload in the same capacity planning conversation.
Where the AI Actually Helps
Anomaly detection instead of thresholds. Fixed thresholds are the weak point of traditional alerting: set tight, they cry wolf; set loose, they miss the event. Anomaly detection fits expected behaviour per series - including daily and weekly patterns - and flags deviation from normal, which is what operators actually mean when they say "tell me when something is wrong". KQL ships native time-series functions for exactly this work.
Scoring on arrival. A model trained offline - fraud risk, failure prediction, quality classification - can score events as they stream, so the alert is not "value exceeded X" but "this transaction resembles the pattern that preceded the last three incidents". Training happens in the data science workload; the stream is where the model earns its keep.
Triage before humans. The emerging pattern pairs detection with agents: the anomaly fires, an agent gathers context - which sensor, what recent history, which runbook applies - and the human receives a briefing rather than a beep. Detection by statistics, enrichment by AI, decision by people.
Designing Rules People Will Not Mute
Every alerting system in history has died the same death: too many alerts, all ignored. The disciplines that keep Activator useful are old ones.
- Alert on conditions someone will act on, and name the owner in the alert
- Prefer anomaly-based conditions for noisy series; keep fixed thresholds for hard limits with real meaning
- Batch the informational tier into digests; reserve interruptions for actionable events
- Route actions into systems of record - tickets, flows - not just chat, so response is tracked
- Review firing rates monthly and retire rules nobody acted on
Start with one stream and two or three rules on an operational process where minutes provably cost money. Expand on evidence. The organisations that fail with real-time bought the platform first and went looking for events later; the ones that succeed had a process bleeding money per minute and built exactly the rule that stopped it.
Sources and Further Reading
Frequently asked
Fabric's streaming workload: eventstreams ingest events from sources like IoT devices, applications and Azure services; eventhouses (KQL databases) store and query them at high volume; real-time dashboards visualise them; and Activator turns conditions in the stream into alerts and actions.
A rules engine over live data: define a condition (temperature above threshold, order volume dropping, anomaly detected) and an action (Teams alert, email, Power Automate flow, pipeline trigger), and Activator watches the stream and fires the action when the condition holds. No polling job to build, no dashboard to babysit.
Three places: anomaly detection over streaming series to catch deviations no fixed threshold would; ML models scoring events as they arrive; and increasingly, agents consuming real-time context. The pattern is detection and triage by machine, escalation to humans with context.
The honest test: would someone act differently if they knew five minutes earlier? For most financial reporting, no, and scheduled refresh is cheaper and simpler. For operations - equipment, logistics, fraud, e-commerce funnels - minutes routinely matter, and that is where the streaming stack earns its cost.
No separate licence: RTI workloads consume Fabric capacity units like everything else. Streaming workloads run continuously though, so their consumption profile is steadier than batch and deserves its own line in capacity planning.
