In today’s data-driven world, organizations need the ability to analyze and act on data as it flows in real time. Microsoft Fabric provides a powerful ecosystem for real-time intelligence, enabling businesses to process, store, analyze, and visualize data with minimal latency. In this blog I will introduce you to the key components that make real-time intelligence possible in Microsoft Fabric, giving you a high-level understanding of how they work together.

Here is a diagram of the components used with Real-Time Intelligence (RTI) in Fabric, followed by a description of each:

Eventstream: Capturing and Processing Data in Motion

Eventstream is the foundational component for real-time data ingestion in Microsoft Fabric. It allows users to collect and process data from multiple sources, such as IoT devices, applications, and external event hubs. Eventstreams are event listeners and wait for messages to be sent to them (data is pushed). This is very unlike pipelines, notebooks, and other traditional data processing tools which pull the data from their sources. Eventstream provides built-in connectors, transformation capabilities, and seamless integration with other Fabric components to ensure that data is formatted and routed efficiently. It supports ingestion from various real-time sources such as Azure Event Hubs, Apache Kafka, and Azure IoT Hub (listed on the left in the above diagram and described here). Additionally, it provides low-latency data streaming while enabling data transformation and enrichment before storage or analysis, such as aggregate, filter, and join (full list of operations listed here). Eventstream supports sending data to the destinations listed on the bottom right of the above diagram and described here. Eventstream has the functionality of Azure Eventhub and Azure Stream Analytics. It is a no-code environment that has an authoring canvas that looks like this:

Eventhouse: Storing Real-Time Data Efficiently

Once real-time data is ingested, it needs a place to be stored and accessed quickly. Eventhouse is a high-performance, scalable storage solution designed specifically for event-driven data. It provides structured storage optimized for real-time analytics, ensuring that data remains accessible for downstream processing. Eventhouse is optimized for large-scale event storage and retrieval, supports time-series and event-based analytics, and integrates seamlessly with other Fabric components for querying and reporting. It can handle up to millions of events per hour. Eventhouse has the functionality of Azure Data Explorer and contains KQL databases, which allow you to query billions of rows in just a few seconds. You can think of Eventhouse as simply managing a group of KQL databases. An Eventhouse looks like:

And a KQL database looks like:

Activator: Triggering Automated Actions

Real-time Intelligence is not just about monitoring data—it’s about taking action based on insights. Activator enables automated workflows by triggering actions based on data patterns, thresholds, or anomalies detected in the event stream. It provides configurable event-driven triggers, integrates with Power Automate, Azure Functions, and other automation tools, and supports business logic and rules-based processing to automate responses efficiently. In short, it is a rule-based engine that detects conditions in event streams and triggers responses: Eventstream captures data in motion, and Activator monitors the data for conditions that warrant a response, and when a condition is met, an alert can notify users, while an action can trigger an automated workflow to address the issue. You can create an alert such that when the number of bikes falls below five, an action is taken that sends a person a Teams message:

KQL Queryset: Analyzing Real-Time Data

Kusto Query Language (KQL) is a powerful query language designed for fast and efficient data exploration. KQL Queryset allows users to run real-time queries against event data stored in Eventhouse, enabling deep insights and pattern detection. It facilitates high-speed querying for real-time event data, supports aggregations, pattern matching, and anomaly detection, and enables data filtering and transformation for dashboards and reports. In addition to KQL, users can also leverage T-SQL for querying structured data in real time, making it easier for those familiar with SQL-based analytics to perform real-time analysis within Microsoft Fabric. The query workspace looks like this:

Real-Time Dashboard: Visualizing Insights Instantly

Real-time intelligence is only valuable if decision-makers can interpret the data quickly. Microsoft Fabric enables the creation of Real-Time Dashboards, providing live visualizations of streaming data without relying on external tools (Real-Time Dashboards do not use Power BI). These dashboards help organizations monitor KPIs, detect anomalies, and make data-driven decisions in real time. They offer live data visualizations with minimal latency, customizable dashboards with interactive filtering, and integration with event-driven alerts and automated actions. If you are from the Power BI world, think of Real-Time Dashboards like DirectQuery, but without the need to load data into a semantic model. It is the equivalent of Azure Data Explorer dashboards. Here is what a Real-Time Dashboard looks like:

Real-Time Hub: The Centralized Control Panel

The Real-Time Hub serves as the central interface for managing all Real-Time Intelligence components in Microsoft Fabric. It allows users to configure, monitor, and optimize real-time data processing, ensuring smooth operation across various components. By consolidating management, monitoring, and alerting capabilities into one place, the Real-Time Hub enhances visibility and control over event-driven data, helping organizations make faster, more informed decisions. The Real-Time Hub looks like:

Power BI and its role in Real-Time Intelligence

Power BI is a comprehensive business intelligence platform that enables users to create reports and dashboards using a variety of data sources. While Power BI can display real-time data, it is not exclusively designed for real-time analytics. Instead, it supports multiple data connectivity modes, including batch processing, live querying, and streaming data ingestion.

A Real-Time Dashboard in Microsoft Fabric using RTI is specifically built for monitoring live data streams, ensuring near-instant updates as new information arrives. These dashboards are optimized for low-latency event tracking and are commonly used for operational monitoring, alerting, and tracking key performance indicators (KPIs) that change rapidly.

In contrast, creating a real-time dashboard in Power BI involves using streaming datasets or DirectQuery mode. Streaming datasets allow for continuous data updates, but they often lack the ability to perform advanced aggregations and transformations compared to RTI components in Microsoft Fabric. DirectQuery mode enables real-time data querying from sources like Eventhouse, but it can introduce some latency depending on query complexity and source performance.

The main differences between a real-time dashboard in RTI and Power BI include data latency, processing methods, and visualization capabilities. While Power BI is excellent for historical analysis, trend discovery, and batch-reporting, a real-time dashboard in RTI is tailored for immediate event-driven insights with minimal delay. By leveraging both, organizations can achieve a balanced approach to real-time intelligence and long-term analytics. An example Power BI report using Eventhouse data:

Summary

In short, here is how all the components work:

1. Eventstream captures and processes live data from various sources.
2. Eventhouse stores the ingested data for quick access and analysis.
3. Activator triggers automated responses based on pre-defined rules.
4. KQL Queryset enables fast querying and analysis of real-time data.
5. Real-Time Dashboards provide instant visibility into key metrics.
6. Real-Time Hub acts as the centralized interface for managing all these components.
7. Power BI generates historical reports from sematic models built from the stored data in Eventhouse.

You can create a logical copy of KQL database data located in an eventhouse by turning on OneLake availability, and all the KQL database data is made available in OneLake. Turning on OneLake availability means that you can query the data in your KQL database because it exists in OneLake (in Delta Lake format) using other Fabric engines such as Direct Lake mode in Power BI, Warehouse, Lakehouse, Notebooks, and more. The OneLake availability is used via Lakehouse shortcuts: go into a Lakehouse and create a shortcut to Microsoft OneLake, and you will see tables under the KQL DB if you have enabled “OneLake availability“.  If not, no tables will show up. More info at Eventhouse OneLake Availability – Microsoft Fabric | Microsoft Learn.

Not only can RTI be used to generate reports/dashboards/queries on new data coming from real-time streaming sources such as Internet of Things (IoT) devices, but it can also be used to replace the operational reporting on source systems to take some of the load off of those systems. For example, you can have an inventory database in Azure SQL Database that an application is using to get up-to-the-second Power BI reports that contain inventory counts. With RTI, the data in the Azure SQL Database can be copied into an eventhouse using eventstream via change data capture (CDC) within milliseconds of it being created, and the Power BI reports can instead be run against the eventhouse to get those inventory counts, reducing the compute load on the application system. For more info on this, check out Operational Reporting with Microsoft Fabric Real-Time Intelligence.

Make sure to check out the Real-Time Intelligence documentation and also what is new and planned. An excellent RTI tutorial where you’ll learn how to set up and use the main features of Real-Time Intelligence using a sample set of data can be found here.

More info:

Microsoft Fabric RTI: Eventhouse and Real-Time Dashboards