Over the past few years, one pattern has become increasingly clear as data platforms evolve: visibility has outpaced operability. Organizations are collecting more telemetry than ever—metrics, logs, events, and streams—but many still struggle to convert that continuous flow of data into timely, confident operational decisions.

That’s why the recent announcement Microsoft Fabric Real-Time Intelligence (RTI) a Leader in the 2025 Forrester Streaming Data Wave (Q4 2025) is particularly meaningful to me. Having worked extensively with Oil & Gas and Telecommunications organizations, I’ve seen firsthand how turning data into action in real time can be truly transformative. For example, in remote sites where battery efficiency and energy management are critical, being able to detect anomalies, predict failures, and act immediately—not hours or days later—can significantly reduce downtime, operational risk, and costs.

Beyond the recognition itself, this moment reflects a broader market shift: streaming platforms are no longer evaluated only on throughput or latency, but on their ability to close the loop between signal, insight, and action—turning raw telemetry into meaningful operational decisions that can differentiate an organization from its competitors.

As shared by Yitzhak Kesselman, Forrester highlights Microsoft’s strengths in messaging, analytics, governance, and both developer and business user experience, enabled by deep, native integration across Azure services. From a technical standpoint, the differentiator is architectural cohesion. Microsoft Fabric RTI removes the traditional boundaries between ingestion, analytical storage, behavioral detection, and response, treating them as a single operational system rather than a collection of loosely connected components.

This aligns closely with what I see organizations building today. As AI agents transition from experimentation to production, they are increasingly operating on streaming data pipelines that demand uninterrupted flow across ingestion, processing, analytics, and decision logic. Any friction along this path creates latency, uncertainty, and operational risk. Microsoft Fabric RTI is designed to remove that friction—enabling teams to move beyond simply observing telemetry and toward actively operating and optimizing systems in real time.

Bridging the Gap Between Telemetry and Decisions

Most organizations already have observability. Dashboards reveal spikes in latency, ingestion backlogs, or error rates—but what’s often missing is operational clarity:

• Why did this deviation occur?

• How long did it persist?

• Which workloads, models, or users were impacted?

• Does this require immediate action—or can it safely be ignored?

Microsoft Fabric emits the raw signals required to answer these questions, but signals alone are not enough. The real challenge is interpreting telemetry in real time, at scale, and in context—and then acting on it quickly and confidently. RTI addresses this gap by delivering a unified, SaaS-native path from event ingestion to guided or automated response, enabling rapid anomaly detection and timely action when it matters most.

Traditional alerting—where fixed metric thresholds trigger notifications—breaks down in real-world streaming environments. Traffic is "bursty", behavior is seasonal, and workloads combine batch, interactive, and streaming patterns. As a result, static thresholds either flood teams with noise or fail to detect true incidents, ultimately leading to costly operational outcomes:

• Over-provisioning and unnecessary scale-ups driven by false positives

• On-call fatigue and context-switching

• Delayed response due to manual triage and correlation

• Brittle rules that require constant maintenance across regions, tenants, or assets

It is nice to see how Microsoft Fabric RTI is solving these challenges with behavioral detection. Metrics are evaluated against learned baselines that account for trend, seasonality, and historical variance. The result: higher signal quality, fewer false positives, faster recovery, and lower operational costs.

Three Preview Capabilities Driving the Shift

1) Real-Time Dashboards + Copilot for Live Data

A real-time visualization layer with sub-second freshness, combined with Copilot for natural-language exploration. Users can chart, explore, and ask questions of streaming data as it arrives—without writing queries. For operators and analysts, this is a true “dream come true”: live data, instant visualizations, anomaly context, and natural-language interaction in a single surface—no custom visualization stacks and no waiting for batch refresh cycles.

Real-Time Dashboards are purpose-built for scenarios that traditional Power BI dashboards were not designed to address. Power BI excels at analytical and decision-support use cases, leveraging semantic models, historical data, and rich visuals to explore trends, slice and dice data, and answer “why” questions—typically with refresh-based or near–real-time data.

By contrast, Real-Time Dashboards are designed for operational monitoring. They connect directly to streaming data in Eventhouse, showing what is happening right now with second-level latency, simple operational visuals, and no semantic model layer.

In short, Power BI helps people analyze and understand outcomes, while Real-Time Dashboards help teams monitor live systems and react immediately.

2) Anomaly Detection

AI-assisted, no-code anomaly detection for time-series data in Eventhouse. By replacing static thresholds with dynamic baselines, it identifies meaningful deviations across latency, throughput, quality of service, and application behavior—dramatically reducing alert noise.

RTI provides built-in, continuously adaptive detection tightly integrated with Eventhouse, KQL, Activator, and the Operations Agent, enabling teams to move from raw signals to action in days rather than months. Compared to traditional ML approaches, it is easier to operate, more reliable in production, and robust to seasonality, scale, and high-cardinality streaming data.

What I particularly appreciate about Fabric RTI is that I, as a data engineer, retain full control through code. Anomaly detection isn’t a black box—I can define it, review it, and operationalize it directly in KQL. Once I have a detection pattern, turning it into an operational anomaly feed is straightforward: I define the time window (e.g., the last six hours), generate a consistent one-minute series, and filter for anomalous points. The result is a clean “anomaly table” that I can pin to a Real-Time Dashboard or use as input to an Activator alert, letting RTI notify the right people or trigger the next step in a workflow. This is why I find RTI so engineering-friendly: the logic is explicit, inspectable, and easy for me to iterate on as the definition of “abnormal” evolves.

In more advanced customer scenarios, simple univariate thresholds are not enough, because anomalies only become visible when multiple signals are evaluated together—for example, when request volume increases while success rate drops and latency rises at the same time. This is where Multivariate Anomaly Detection (MVAD) in Fabric RTI becomes extremely powerful. Instead of building and maintaining custom Machine Learning (ML) pipelines, RTI allows us to define a set of correlated metrics, score them jointly using a Fabric‑managed MVAD model, and surface anomalies as structured outputs that can immediately drive dashboards, alerts, or operational workflows.

From an engineering perspective, the key advantage remains the same: the logic is still explicit and code‑driven, easy to reason about, and naturally integrated into the Eventhouse → KQL → Activator pipeline that RTI is designed around.

This are such some strong examples of why RTI is engineering-friendly: the logic is explicit, inspectable, versionable, and easy to evolve as the definition of “abnormal” changes over time.

3) Operations Agent

An agentic layer that reasons over live data and historical context and proposes actions in Microsoft Teams, with human approval and full auditability. It closes the last mile from detection to response by applying consistent runbooks and lessons from past incidents, accelerating Mean-Time-To-Repair (MTTR) while preserving governance and traceability.

Don’t confuse Data Agents in Fabric with the RTI Operations Agent—they serve complementary but distinct roles. Data Agents act as an interactive analyst copilot, enabling users to ask natural-language questions and receive explanations, summaries, and insights grounded in OneLake data on demand. In contrast, the RTI Operations Agent is an always-on operational agent that continuously monitors real-time data in Eventhouse, detects conditions such as anomalies or threshold breaches, and recommends—or automatically triggers—actions, typically with human approval.

In short, Data Agents help people understand their data, while the RTI Operations Agent helps the business act on data in real time (aka "run operations").

A Practical Pattern for Incident Analysis

Turning raw anomalies into actionable insights requires a repeatable workflow. In Microsoft Fabric, this maps to the RTI architecture:

1) Select the Metric and Operational Lens

Start with a key signal to monitor:

• Latency: average/p95 query duration

• Load: requests, ingestion throughput

• Quality: error rates, failed operations

2) Stabilize the Signal

Aggregate to a consistent time grain (1–5 minutes) to reduce noise and improve modeling accuracy.

3) Detect Deviations from Expected Behavior

Use RTI Anomaly Detection to:

• Launch detectors directly from Eventhouse or Real-Time Hub

• Use system-recommended models or tune sensitivity

• Preview anomalies on historical data before going live

• Enable continuous monitoring and publish anomalies back to the hub

Advanced teams can use KQL time-series decomposition or inline Python for multivariate scenarios.

4) Convert Anomalies into Incident Windows

Group nearby anomalies into incident windows and attach operational attributes:

• Peak severity – strongest deviation

• Duration – how long it lasted

• Density – number of anomalous points

This turns spikes into analyzable timelines, differentiating short blips from sustained operational impact.

5) Enrich with Context

Combine incident windows with Fabric monitoring metadata to answer:

• Which models, datasets, or reports were affected?

• Which operations coincided with the incident?

• Which users or workspaces experienced impact?

6) Persist the Incident Ledger

Store incident summaries (IncidentId, Start/End, Duration, PeakSeverity, Impacted Models/Users/Operations) for:

• Trend analysis

• Correlation with deployments

• Feeding Operations Agent for smarter guided responses

This workflow moves teams from reactive monitoring to proactive, real-time operational management.

Fabric RTI vs. Databricks: A Customer-Focused Perspective

In Microsoft Azure we offer our customers, Microsoft Fabric and Azure Databricks; both offer anomaly detection, but they serve different purposes.

Microsoft Fabric RTI is designed for real-time operational decisioning:

• Continuous detection on streaming time-series data

• Behavioral models that learn normal system patterns

• Integrated detection, context, and guided response

• No-code configuration for broad adoption

• Low-latency, in-path detection for immediate action

While Azure Databricks anomaly detection focuses on batch-oriented data quality:

• Scheduled scans of Delta tables

• Checks for freshness, completeness, and schema integrity

• Excellent for governance and compliance

• Findings are typically reviewed offline, not in real time

My learning? We should use Fabric RTI when speed, context, and operational action matter. We could also use Azure Databricks when batch data quality and governance are the priority, and your organization is already using Databricks.

Conclusion: From Observability to Operability

Fabric RTI is designed to close the operational loop:

• Real-Time Dashboards + Copilot allow teams to explore, visualize, and query live data instantly.

• Anomaly Detection continuously surfaces behavioral deviations and integrates directly with dashboards and workflows.

• Operations Agent reasons over live and historical data and proposes guided actions in Teams, with human approval and auditability.

Together, these capabilities turn raw telemetry into actionable insights, accelerating response times while preserving governance.

The Forrester recognition reinforces what many customers are already experiencing: Microsoft Fabric Real-Time Intelligence enables a new operating model for data platforms—one that connects telemetry directly to decisions and actions. Start with one metric. Apply a behavioral lens. Close the loop between detection and response. And move from monitoring dashboards to operating your systems in real time.

Thanks for reading! If you’re interested, here are some other articles I’ve written about Microsoft Fabric:

• Uniting SAP Data and Azure Analytics to Power Enterprise AI | December 1, 2025

• Microsoft Fabric: Redefining the Future of Enterprise Data Intelligence Platforms | October 8, 2025

• Decoding the Snowflake and Microsoft Partnership | August 20, 2025

• Unlocking Business Agility with Multi-Agent AI and Microsoft Fabric’s Data Mirroring | August 7, 2025

• Shortcuts and Mirroring at Microsoft Fabric | December 29, 2023