WorkIQ CLI returns 403 Forbidden / caller not entitled despite successful tenant enablement and licensing

[klittle32]

Summary

WorkIQ is not usable in our tenant even after full admin enablement and user re-authentication.
workiq ask consistently returns 403 (Forbidden), and workiq fetch -u /me returns The caller is not entitled to use this tool.

CLI version

workiq version → 1.0.0.28144

Repro steps

1. Run tenant provisioning/verification scripts:
   • pwsh -NoProfile -File scripts/Enable-WorkIQToolsForTenant.ps1
   • pwsh -NoProfile -File scripts/Verify-WorkIQTenant.ps1
2. Ensure account is logged in:
   • workiq auth logout
   • workiq auth login --account <user>
   • workiq auth consent -s "Mail.Read Sites.Read.All People.Read.All OnlineMeetingTranscript.Read.All Chat.Read ChannelMessage.Read.All ExternalItem.Read.All" --account <user>
3. Run:
   • workiq ask --json -q "did Kearns send me an email today?"
   • workiq fetch -u /me

Actual behavior

• workiq ask --json ... returns:
  • {"isError":true,"error":"Response status code does not indicate success: 403 (Forbidden).",...}
• workiq fetch -u /me returns:
  • The caller is not entitled to use this tool.

Also reproduced across multiple prompts and agent IDs (including bizchat-as-gpt-scenario and planner declarative agent).

Expected behavior

After successful tenant enablement + consent + login, ask and fetch should execute (or return a specific missing-permission diagnostic if something is still missing).

Evidence that setup appears correct

• Verify-WorkIQTenant.ps1 reports all checks passed:
  • required MCP service principals exist
  • Work IQ CLI SP exists
  • required Graph delegated grants present
  • MCP server grants present
• Enable-WorkIQToolsForTenant.ps1 reports permissions already granted.
• User has Microsoft_365_Copilot SKU assigned (service plans reported as provisioned).
• MFA is enabled/enforced for the user:
  • Graph /beta/users/{upn}/authentication/requirements returned perUserMfaState: enforced
• WorkIQ CLI config:
  • default account set correctly
  • reproduces with both experimental=true and experimental=false
• workiq agents list succeeds, but ask/fetch remain blocked.

Suspected issue

A backend entitlement gate mismatch: tenant/app consent and licensing appear valid, but execution endpoints still treat the caller as not entitled.

[yuriyasui]

I have the same issue...

[Quinn87]

Confirming identical behavior - additional data point from a different tenant.

Environment:

• Using WorkIQ as an MCP server plugin in Github Copilot (VS Code /CLI)
• Tried both the Github-hosted plugin and the official Microsoft plugin
• M365 Copilot license confirmed assigned and provisioned
• All WorkIQ service principals present in tenant
• Had to manually add fdcc1f02-fc51-4226-8753-f668596af7f7 (Work IQ) today

Symptoms (Identical to OP)

• Search_paths works
• list_agents - "The caller is not entitled to use this tool"
• fetch /me - The caller is not entitled to use this tool"
• ask - "HTTP error: ... Status: Forbidden."

This was previously working in my tenant. The entitlement gate failure started appearing without any known licensing or consent changes on my side. Switching between the Github plugin and Microsoft plugin made no difference.

Agree with the suspected root cause: backend entitlement gate mismatch where tenant config and licensing are valid but execution endpoints reject the caller anyway.

[RyanAughtry]

Noting I have the same issue

[karamem0]

I have encountered the same issue. Are there any updates on this?

[Eaxlol]

Confirming identical behavior - additional data point from a different tenant.

Environment:

• Using WorkIQ as an MCP server plugin in Github Copilot (VS Code /CLI)
• Tried both the Github-hosted plugin and the official Microsoft plugin
• M365 Copilot license confirmed assigned and provisioned
• All WorkIQ service principals present in tenant
• Had to manually add fdcc1f02-fc51-4226-8753-f668596af7f7 (Work IQ) today

Symptoms (Identical to OP)

• Search_paths works
• list_agents - "The caller is not entitled to use this tool"
• fetch /me - The caller is not entitled to use this tool"
• ask - "HTTP error: ... Status: Forbidden."

This was previously working in my tenant. The entitlement gate failure started appearing without any known licensing or consent changes on my side. Switching between the Github plugin and Microsoft plugin made no difference.

Agree with the suspected root cause: backend entitlement gate mismatch where tenant config and licensing are valid but execution endpoints reject the caller anyway.

Same config and also same issue from my side

[pavele]

Not working on my side, either. Exactly the same behavior.

[flawzies]

The issue for me was solved by enabling Cost Management here:
https://admin.cloud.microsoft/ > Copilot > Cost Management > Configuration > [Add Spending Policy]

[manish141989]

I have the spending policy in place with users added to the policy and Work IQ enabled still I get this error:

workiq fetch -u /me
The caller is not entitled to use this tool.

[Will-Babbitt]

This seems be a problem with newer versions. Pinning my workiq version to 0.4.1 resolved this issue for me

[manish141989]

so you downgraded the workiq version to 0.4.1 ?

[karamem0]

I was able to resolve this issue.
After accessing https://admin.cloud.microsoft/#/copilot/costmanagement/overview and adding a billing policy for the Work IQ API, the error no longer occurred.

[sourangshupal]

The issue for me was solved by enabling Cost Management here: https://admin.cloud.microsoft/ > Copilot > Cost Management > Configuration > [Add Spending Policy]

For me also, just work even with the latest version.

[jan-schuermeier]

I have the same problem.

Reproducing on a fresh tenant — complete setup, same no-license error

Environment:

• Work IQ CLI v1.0.0 (also reproduced with v0.4.1 → CopilotConversation403Error)
• Windows 11, disableBrokeredAuth=true (browser auth working, WAM bypassed)
• Fresh tenant, single user (redacted)

Setup completed and verified via PowerShell/Graph:

• ✅ Work IQ Service Principal (fdcc1f02-fc51-4226-8753-f668596af7f7) present in tenant
• ✅ CLI app (ba081686-5d24-4bc6-a0d6-d034ecffed87) has WorkIQAgent.Ask with ConsentType: AllPrincipals
• ✅ workiq auth consent completed successfully (browser flow)
• ✅ Cost Management activated at admin.cloud.microsoft with Azure Pay-As-You-Go
• ✅ Spending policy for Work IQ API covering all users
• ✅ Discovery setting "Allow users to discover AI experiences enabled by usage-based billing" enabled
• ✅ Enable-WorkIQToolsForTenant.ps1 ran successfully

Consistent result after all steps + 6+ hours propagation time:

With v1.0.0 (direct WorkIQ A2A endpoint):

It looks like you don't have a valid license. To get access, please check with your administrator.

With v0.4.1 (same underlying 403 as reported in this issue):

Error: Unexpected error: Exception of type 'ApiSdk.Models.CopilotConversation403Error' was thrown.

Token is acquired successfully for scope api://workiq.svc.cloud.microsoft/.default, but the backend consistently rejects the request. The v1.0.0 CLI wraps the 403 as a "no valid license" message. Deleted and recreated the spending policy — no change.