May 5, 2026Microsoft Fabric

Episode 325 – Microsoft Fabric March 2026 Feature Summary (Part 3)

Episode 325 closes out the real-time chapter of the Microsoft Fabric March 2026 Feature Summary. Recorded on Friday, April 17th, 2026 — back-to-back with Episode 324, which is why Jason skips the weather banter this time — John and Jason dig into the Real-Time Intelligence section, which is right in John’s wheelhouse. Data Factory and Power BI are still on the docket for future episodes; this one focuses on Business Events, DeltaFlow, Spark notebooks on streams, and a pile of quality-of-life upgrades across Event Stream and Event House.

Business Events in Microsoft Fabric (Preview)

Business Events are action-based alerting done properly. As Jason puts it, “it’s almost like I’ve been asking for it for the past 10 years.” The pattern: define a query via a User Data Function or a notebook, register that output and its schema in the Real-Time hub, and let Activator run against it on a schedule. When the conditions match, Activator does what Activator does — email, Teams, a workflow kickoff.

The caveat the hosts circle back on is the skill floor. Business Events require UDFs or notebooks, and both are full-code experiences with no Wrangler equivalent. “It’s not an end-to-end user tool,” John says. Jason goes one further: “It’s not even a medium user tool.” Expect this to be a developer-driven feature, with agentic code generation becoming the more realistic on-ramp for teams without deep code skills. The hosts also flag that although the feature lives in the RTI section because of the Real-Time hub schema registry, it isn’t a KQL-only feature — you’ll need Spark to evaluate the UDF or notebook in the background. Full documentation link in the blog post is currently pointing at a Bing search result, which both hosts agree is probably an AKA resolver bug rather than missing docs — but it’s been a month, so a note to the team is in order.

DeltaFlow: CDC feeds into Fabric Event Streams (Preview)

Fabric Eventstreams DeltaFlow connects directly to change data capture feeds on operational databases — Azure SQL, SQL MI, SQL on VM, PostgreSQL — and lands the changes as analytics-ready, flattened rows rather than deeply nested Debezium JSON. DeltaFlow autodiscovers source schemas, registers them in the Fabric Schema Registry, automatically creates and manages destination tables, and handles schema evolution as source tables change.

John’s framing: if you’ve been chasing change event streaming as a push pattern, DeltaFlow scratches the same itch in a pull model. The use case he calls out is audit and history — a transactional database maintains state, but DeltaFlow gives you the history of that state as a first-class stream. A separate blog post goes deeper into the setup, and — unlike the Business Events link — that one actually works.

Real-time stream processing with Spark Notebooks (Preview, with a cost warning)

This is the one where John has hands-on time. Real-time stream processing with Fabric Event Stream and Spark notebooks lets you drop a notebook into an Event Stream as a transformation step, backed by Spark Structured Streaming. If the SQL operator (more on that below) is the SQL flavor, this is the Python flavor — write whatever logic you want and output wherever you want.

John used it last week to replace an update-policies-in-Kusto pattern with a notebook-driven transformation. It worked. A few gotchas along the way: you have to parameterize a cell in the notebook so the Event Stream can connect to it, and the documentation on that piece is light — AI got him over the hump. The bigger gotcha that tripped him up was that the code in his notebook ended with a `spark.stop()` call, which completely defeats the purpose of a continuously running stream. Once that was removed, everything lit up.

The downside is the one Jason suspected: cost. John benchmarked the notebook-based pipeline against the Event House plus update-policies equivalent running on the same weather data. The notebook approach came in at roughly eight times the cost. That Spark cluster is running continuously because the stream is running continuously — it’ll nap when the stream quiets down, but while it’s live, it’s billed. Jason’s read: “It’s not, let’s see how much we can charge for a thing.” John agrees — this is about providing options — and both hosts expect the cost profile to evolve as Microsoft has a history of adjusting pricing to drive adoption. Use it when it’s the right tool, but go in with eyes open. Event House remains purpose-built for real-time streams; this is the escape hatch when you need custom Python logic.

Operations Agent playbook improvements

The Operations Agent — first announced back at Build — picked up playbook improvements and better message handling this month. It’s an autonomous agent that watches operations in the background for weird things. Neither host has used it yet, and Jason wonders out loud whether it overlaps with Business Events or the anomaly detector in Event Stream. John’s read: it’s closer to anomaly detection, but non-deterministic where anomaly detection is deterministic. “Agents are non-deterministic, really,” he says. “The closer you get to a deterministic set of requirements, the closer you get to more programmatic access.” The general AI heuristic in a single sentence.

Live updates, Event Stream SQL GA, and late event handling

Live updates for real-time dashboards are genuinely useful when your data is bursty. Instead of hammering the source database every five seconds on a fixed schedule, the dashboard now detects when the underlying data has actually changed and runs the queries then. For steady-state reports, the fixed schedule still makes sense — this is the escape hatch for anything with variable frequency.

The Event Stream SQL operator reached GA, and the GA brings an important unlock: stream branching. Prior to GA, the SQL operator could only emit a single output stream. Now you can branch based on the SQL output and send results to multiple destinations — a meaningful difference for any pipeline that needs to fork on a condition. Late event arrival handling also got a refresh. Because Event Stream uses the Azure Streaming Analytics engine, concepts like sliding-window aggregates exist here that don’t exist in plain SQL, and the updates smooth out how signals arriving after a partition close are handled.

Anomaly detection as a source, Copilot for RTI dashboards, and the “stop recreating Power BI” moment

Anomaly detection can now be a source in Event Stream — detect an anomaly and that becomes the input to a different stream. Which, as Jason and John work out, makes this “the anomalous stream service” on the path to becoming a service mesh of anomalies. Good fun, but a useful pattern too.

Series colors for real-time dashboard visuals land alongside Copilot support (preview). The hosts’ editorial: the styling in real-time dashboards has historically been built for administrators, not end users, and bringing it closer to Power BI parity raises a real question about why the two are diverging in the first place. The line that lands: “stop recreating Power BI in real-time dashboards” — even as the incremental improvements are welcome.

KQL function editor and workspace monitoring templates

Event House Kusto function editing used to be awkward — create the function, run it somewhere else, come back, rewrite, repeat. The new in-editor experience lets you open and edit functions from the node panel and run them interactively. Parameterized functions now prompt for values instead of requiring a wrapper query. John calls it a very welcome change; Jason agrees it feels right.

Workspace monitoring picked up dashboard templates. Pick a template and go. The recurring editorial holds here too: don’t use a tool to measure the same tool. Workspace monitoring stands up an Event House in a workspace, and that Event House consumes its own capacity. Great data if you can tolerate the observer effect on your capacity; just know it’s happening.

And that wraps the Real-Time Intelligence section. Next episode covers Data Factory — Copy Job, Dataflow Gen2, classic Data Factory updates, and the mirroring section — plus Power BI is still waiting in the wings. Both hosts are heading to Cologne, Germany soon, where they need list mirroring and a few other things to actually show up in their tenants so they can rewrite a workshop section without relying on theory. Fingers crossed.

Links

Microsoft Blog Posts

Previous Episodes

Events

Microsoft Fabric Community Conference

Subscribe: SoundCloud | iTunes | Spotify | TuneIn | Amazon Music

Tags: Activator, anomaly detection, Business Events, CDC, Copilot, DeltaFlow, Event House, Event Stream, Event Streams, Fabric March 2026, KQL, Microsoft Fabric, Operations Agent, real-time dashboards, Real-Time Intelligence, RTI, Spark notebooks, Spark Structured Streaming, workspace monitoring