Real-Time Intelligence in Fabric: KQL, Eventstreams, and Activator for Power BI Teams

Your Power BI dashboards refresh once a day. Your data changes every second. IoT sensors emit readings continuously. Sales transactions happen in real time. Customer interactions generate events every minute.

If your dashboards are always yesterday's news, you need Real-Time Intelligence.

Microsoft Fabric's Real-Time Intelligence suite brings streaming data and real-time analytics to Power BI. KQL databases for fast querying, Eventstreams for data ingestion, Activator for automated actions, and real-time dashboards for live visualisation — all within your Fabric workspace.

This guide covers what Real-Time Intelligence is, how each component works, and how Power BI teams can use it to move from batch to real-time.

The Three Pillars

Real-Time Intelligence has three core components:

1. KQL Databases

KQL (Kusto Query Language) databases are optimised for fast querying of large volumes of streaming data. They are the analytical engine behind Real-Time Intelligence.

What KQL is:

• A query language designed for log and telemetry data
• Similar to SQL but optimised for time-series and event data
• Supports aggregations, joins, windowing functions, and geospatial queries
• Runs queries in seconds over billions of rows

How it differs from SQL and DAX:

Creating a KQL database in Fabric:

1. Open your Fabric workspace
2. Click + New → KQL Database
3. Name your database (e.g., "IoT-Telemetry")
4. The database is created with a KQL query endpoint

2. Eventstreams

Eventstreams are Fabric's real-time data ingestion layer. They capture, transform, and route streaming data from multiple sources.

Data sources supported:

• Azure Event Hubs
• Azure IoT Hubs
• Apache Kafka
• Custom endpoints (HTTP, MQTT)
• Sample data (for testing)

What Eventstreams do:

1. Ingest — capture streaming data from sources in real time
2. Transform — filter, map, and enrich events as they flow through
3. Route — send processed events to KQL databases, lakehouses, or other destinations

Creating an Eventstream:

1. In your Fabric workspace, click + New → Eventstream
2. Add a data source (e.g., Azure Event Hub)
3. Configure the connection and authentication
4. Add a destination (e.g., your KQL database)
5. Optionally add transformations (filter, map, aggregate)
6. Start the stream

3. Activator

Activator is the automation layer. It monitors data in real time and triggers actions when conditions are met.

What Activator does:

• Monitors KQL databases and Eventstreams for threshold breaches
• Triggers automated actions: send Teams notifications, email alerts, Power Automate flows
• Supports complex conditions (time windows, consecutive breaches, trend detection)
• No coding required — configure rules through a visual interface

Example use cases:

• Alert when sales drop below $10,000/hour
• Notify the team when error rates exceed 5% in the last 15 minutes
• Trigger a Power Automate flow when a sensor reading exceeds a threshold
• Send a Teams message when inventory levels fall below reorder point

NL2KQL: Talking to Streaming Data

The game-changer for Power BI teams is NL2KQL — using Data Agents to query KQL databases with natural language.

How it works:

1. Create a Data Agent and connect it to your KQL database
2. The agent translates natural language questions into KQL queries
3. The query runs against the KQL database
4. Results are returned in natural language

Example questions:

• "Are there any anomalies in today's error rates?"
• "What is the average response time in the last hour?"
• "Which IoT device has the highest temperature reading right now?"
• "Show me the trend of active users over the last 24 hours"

Setting up NL2KQL:

1. Create a Data Agent in your Fabric workspace
2. Add your KQL database as a data source
3. Write custom instructions explaining your data schema and terminology
4. Add example queries showing the KQL patterns the agent should use
5. Test and iterate

Example custom instructions for NL2KQL:

      You are a real-time analytics assistant. You query KQL databases containing IoT telemetry data.
      
      Data conventions:
      - "Errors" = rows in the "Events" table where Level == "Error"
      - "Response time" = column "DurationMs" in the "Requests" table
      - "Active devices" = distinct DeviceId in the last 5 minutes
      - All timestamps are in UTC
      
      KQL conventions:
      - Use ago() for relative time: ago(1h) = 1 hour ago
      - Use bin() for time grouping: bin(TimeGenerated, 5m) = 5-minute buckets
      - Use summarize for aggregations
      - Always include a time range in queries
      

Real-Time Dashboards

Power BI can connect directly to KQL databases for real-time dashboards that update without manual refresh.

Creating a real-time dashboard:

1. In Power BI Desktop, click Get Data → Azure Data Explorer (Kusto)
2. Enter your KQL database endpoint
3. Write KQL queries for your visuals
4. Configure auto-refresh (every 1 second to every 30 minutes)
5. Publish to the Power BI Service

Alternative: Fabric Real-Time Dashboards

Fabric also offers native real-time dashboards that connect directly to KQL databases:

1. In your Fabric workspace, click + New → Real-Time Dashboard
2. Add tiles with KQL queries
3. Configure refresh intervals
4. Share with your team

When to use each:

• Power BI reports — when you need rich interactivity, DAX measures, and complex layouts
• Fabric Real-Time Dashboards — when you need sub-second refresh and simple KQL-based visuals

Use Cases for Power BI Teams

IoT Monitoring

Scenario: A manufacturing company has 500 sensors across 3 factory floors. Sensors emit temperature, humidity, and vibration readings every 5 seconds.

Solution:

1. IoT Hub → Eventstream → KQL database
2. Data Agent connected to KQL database for natural language queries
3. Real-Time Dashboard showing live sensor readings
4. Activator alerts when readings exceed thresholds

Questions the team can ask:

• "Which sensors are currently showing abnormal readings?"
• "What is the average vibration on Factory Floor 2 today?"
• "Alert me if any temperature exceeds 85°C for more than 10 minutes"

Live Sales Tracking

Scenario: An e-commerce company wants to monitor sales in real time during flash sales and promotional events.

Solution:

1. Transaction events → Eventstream → KQL database
2. Real-Time Dashboard showing live sales by product, region, and channel
3. Activator alerts when sales velocity drops below expected levels
4. Data Agent for ad-hoc questions from the sales team

Questions the team can ask:

• "What are our top-selling products right now?"
• "How does today's sales velocity compare to last week's flash sale?"
• "Are there any regions underperforming in the last hour?"

Anomaly Detection and Alerting

Scenario: A financial services company monitors transaction patterns for fraud detection and operational anomalies.

Solution:

1. Transaction events → Eventstream → KQL database (with 90-day retention)
2. KQL queries using series_stats() and series_fit_line() for anomaly detection
3. Activator for automated alerts on suspicious patterns
4. Data Agent for compliance team queries

Questions the team can ask:

• "Are there any unusual transaction patterns in the last hour?"
• "Which accounts have the highest transaction volume today?"
• "Show me all transactions over $50,000 in the last 24 hours"

Architecture: How It All Fits Together

Here is how Real-Time Intelligence fits into your Fabric architecture:

      Data Sources          Ingestion           Storage           Analytics          Distribution
      -----------          ---------           -------           ---------          ------------
      IoT Sensors    →     Eventstream    →    KQL Database  →   Real-Time Dashboard  →  Teams
      Transaction    →     Eventstream    →    KQL Database  →   Data Agent (NL2KQL)  →  M365 Copilot
      Log Data       →     Eventstream    →    Lakehouse     →   Power BI Report      →  Email
                             ↓                    ↓
                          Activator           AI Functions
                          (thresholds)        (sentiment, etc.)
      

Key integration points:

• OneLake: KQL databases and lakehouses share the same OneLake storage layer. Data in KQL databases is accessible from lakehouses and vice versa.
• Power BI: Can connect to KQL databases directly via KQL connector or through Direct Lake mode.
• Data Agents: Can query KQL databases (NL2KQL), semantic models (NL2DAX), and lakehouses (NL2SQL) from a single agent.
• AI Functions: Can process data from KQL databases using Fabric notebooks with pandas or PySpark.

Licensing

Real-Time Intelligence components have the following licensing requirements:

All Real-Time Intelligence features require Fabric capacity. They are not available with Power BI Pro alone.

Getting Started

If you are new to Real-Time Intelligence, start here:

1. Create a KQL database in your Fabric workspace (5 minutes)
2. Load sample data using the built-in sample data feature (2 minutes)
3. Run KQL queries in the database explorer to learn the language (30 minutes)
4. Create an Eventstream connecting to a test data source (10 minutes)
5. Build a real-time dashboard with auto-refresh (15 minutes)
6. Set up an Activator rule for threshold alerting (10 minutes)
7. Create a Data Agent with NL2KQL for natural language queries (30 minutes)

Total time to get a working real-time pipeline: approximately 2 hours.

Summary

Real-Time Intelligence bridges the gap between your Power BI dashboards and your live data. KQL databases handle the speed. Eventstreams handle the ingestion. Activator handles the automation. Data Agents handle the natural language interface.

The architecture is built. The integration with Power BI is native. The only question is whether your team is still looking at yesterday's data when they could be looking at right now.