Planning
Infrastructure planning & optimisation
Use Cases that surface capacity risk, lifecycle exposure, refresh pipelines, and cloud cost - without touching the full estate.
Know it's full before it's full.
An agent scoped to production clusters surfaces at-risk hosts, trending headroom, and a recommended action - without ever touching the rest of the estate.
What it surfaces
- At-risk hosts before they page you
- 90-day capacity trend per cluster
- Recommended rebalance or expansion action
- Refresh opportunity for hosts past headroom threshold
Patch what's exposed, before it's exploited.
Scoped to a defined fleet, the agent returns which hosts are running end-of-support OS versions, what's exposed, and what the remediation path looks like - enriched with vendor lifecycle data.
What it surfaces
- End-of-support OS counts and CVE exposure
- Vendor lifecycle dates from OneIQ's enriched library
- Upgrade vs. replace recommendation per host group
- The compliance conversation your customers need to have
Turn aging hardware into a plan, not a surprise.
Aging hardware identified, costed, and prioritised into a migration sequence. The zone returns the refresh candidates, estimated cost, and a phased wave plan - the starting point for your next hardware conversation.
What it surfaces
- Refresh candidates prioritised by age and EoS date
- Hardware cost modelling from enriched pricing data
- Phased wave plan for customer sign-off
- Leads directly into the hardware and services you already sell
See the waste. Then fix it.
A unified view across cloud and on-prem, scoped to what's actually wasteful. The agent surfaces over-provisioned workloads, idle instances, and the blended cost picture - so the conversation moves from "should we optimise" to "here's exactly what to do."
What it surfaces
- Idle and over-provisioned instances with dollar impact
- Blended on-prem + cloud cost picture in one answer
- Right-sizing recommendations by workload pool
- Ongoing managed service opportunity for cost governance
Operational
AIOps & day-to-day operations
Governed zones that answer operational questions in real time - without an agent ever touching the full estate.
Know the cause before the coffee's done.
When something pages, an agent scoped to the affected environment returns probable cause, contended resources, and a recommended action - before the on-call engineer has finished coffee.
What it surfaces
- Probable root cause in seconds, not minutes
- Contended resource identified by host and type
- Recommended remediation action ready to action
- Audit trail of what the agent saw and when
See the blast radius before you open the window.
Before a maintenance window opens, an agent scoped to the change envelope returns blast radius, dependent workloads, and shared storage paths - so the team knows what they're touching before they touch it.
What it surfaces
- Blast radius before the change window opens
- Dependency map across workloads and storage
- Risk rating with recommended proceed/defer decision
- Evidence package for change advisory board
Catch the breach before the customer does.
Continuous agent queries flag workloads trending outside agreed performance envelopes before they breach SLA - giving your team the conversation before the customer has it.
What it surfaces
- SLA breaches in the trailing 7 days by workload
- Workloads trending toward breach before it happens
- Headroom margin per tier with recommended action
- Managed service evidence for your QBR deck
Commercial
Partner revenue & customer value
Use cases that directly produce proposals, savings conversations, and recurring managed service opportunities.
One query. A boardroom-ready report.
A single agent query across a customer's estate produces a governed infrastructure health report - refresh pipeline, cloud candidates, lifecycle risk - ready to export as a proposal or QBR deck in minutes.
What it surfaces
- Full estate health report in minutes
- Refresh, migration, and cloud pipeline in one view
- Exportable proposal-ready output per customer
- Repeatable at scale across your entire account base
Turn licensing waste into your next conversation.
An agent scoped to software inventory surfaces over-provisioned and unlicensed deployments - the data your customer needs to renegotiate their renewal, and the conversation you need to be leading.
What it surfaces
- Gap between licensed and running instances
- Dollar value of over-licensing ready for renewal talks
- Unlicensed deployments before the vendor audit finds them
- Data to lead the renewal conversation, not react to it
Turn power draw into a sustainability story.
Power draw and density data enriched with carbon intensity, giving customers a data-centre ESG report they can take to their sustainability team - and opening a managed efficiency conversation for you.
What it surfaces
- PUE and carbon intensity per data centre
- Idle load as a percentage of total draw
- ESG-ready report for the customer's sustainability team
- Efficiency opportunity to lead a consolidation conversation
They already bought Copilot. Now let it talk to their infrastructure.
Most of your customers already run Microsoft 365 Copilot - or are one upgrade away from it. OneIQ ICG plugs into Copilot as a governed MCP connector, so the AI they already pay for can answer real questions about their estate. No new AI vendor to evaluate, no new tool for IT to learn - just their existing Copilot, suddenly useful for infrastructure.
What it surfaces
- An upsell path into your existing M365 install base - no new vendor conversation
- Two recurring revenue lines from one deal: the Copilot license upgrade and the OneIQ ICG subscription
- An easy entry point for smaller accounts that can't justify dedicated AI infrastructure spend
- Requires a full Microsoft 365 Copilot license with Generative Orchestration and Copilot Credit capacity - part of what you're upgrading them into
Security & Compliance
The reason the security team says yes
Governed zones that surface exposure, close audit gaps, and produce evidence packages - without an agent ever reading more than it needs to.
Find the open door before someone else does.
A zone scoped to the perimeter surfaces hosts running end-of-life OS with public-facing ports open - prioritised by CVSS score, so remediation effort goes to the highest risk first.
What it surfaces
- EoL hosts with open public-facing ports
- CVE exposure ranked by CVSS score
- Patch or isolate recommendation per host
- Evidence for pen test or Cyber Essentials submission
See the trust you didn't mean to grant.
An inventory of workloads still relying on implicit trust - flat network segments, no microsegmentation - prioritised by criticality. The starting point for the zero-trust programme your customer keeps deferring.
What it surfaces
- Workloads on flat segments with implicit trust
- Microsegmentation gaps ranked by service criticality
- Starting point for a zero-trust programme proposal
- Defensible position for the CISO conversation
One query. An audit-ready snapshot.
On-demand agent query produces a point-in-time snapshot of the estate - patch compliance, access controls, inventory - packaged as an evidence bundle for ISO 27001, Cyber Essentials, or SOC 2 submissions.
What it surfaces
- Point-in-time estate snapshot for audit submissions
- Patch compliance percentage across scope
- Exportable PDF and JSON evidence bundle
- Repeatable on demand - no manual data gathering
Specialist
Vertical & situational use cases
High-value zones for specific estate types and one-time commercial situations where governed infrastructure intelligence changes the outcome.
Consolidate the desktops nobody's using.
A zone scoped to virtual desktop pools surfaces over-provisioned desktop VMs and recommends consolidation targets - turning an inherited sprawl into a licensing and infrastructure saving conversation.
What it surfaces
- Over-provisioned VDI VMs with utilisation evidence
- vCPU reduction target and licensing saving estimate
- Consolidation recommendation by pool
- Managed VDI optimisation service opportunity
Find the gap before disaster does.
Cross-referencing production inventory against backup job coverage surfaces unprotected workloads and stale restore verification - the gaps your customer doesn't know they have until they need them.
What it surfaces
- Unprotected production hosts by criticality
- Days since last verified restore test
- Risk rating with immediate remediation priority
- Managed backup service or DR retainer opportunity
Know what you're buying, in hours not weeks.
Rapid estate discovery and enrichment during an acquisition gives the acquiring team a governed view of inherited infrastructure - vendor mix, EoS exposure, cloud spend, and integration complexity - within hours of access.
What it surfaces
- Full estate picture in hours, not weeks
- EoS exposure and cloud spend for integration costing
- Vendor mix and complexity rating for the deal team
- Immediate managed service opportunity post-close
Autonomous & Agentic Loops
The governed perception layer for systems that act.
OneIQ ICG doesn't execute - it sees. Third-party autonomous and self-healing systems hook into OneIQ ICG as their read-only, scoped view of the estate. The governance constraint is what makes autonomous action acceptable to security teams.
See it. Then let it heal itself.
An autonomous remediation system queries OneIQ ICG to assess current estate state, executes a corrective action, then re-queries OneIQ ICG to verify the fix. OneIQ ICG is the governed perception layer - the execution system never touches the estate directly through OneIQ ICG.
What OneIQ ICG enables
- Closed-loop remediation with a governed perception step
- Agent can only see what the zone permits - no unrestricted estate access
- Audit trail of every query the autonomous system made
- Security team can approve the loop because OneIQ ICG bounds it
Different agents. Different views. Same governance.
A planning agent and an execution agent hold different zones. The planning agent sees the full estate to reason about what to do. The execution agent is scoped only to what it is about to touch. OneIQ ICG enforces the boundary between them - by design, not by policy.
What OneIQ ICG enables
- Least-privilege access enforced at the data layer, not application logic
- Planning and execution agents separated by zone scope
- Blast radius contained structurally - not dependent on agent behaviour
- Each agent's queries independently auditable
Watch continuously. Act only when it matters.
An orchestration platform polls OneIQ ICG on a schedule. The agent wakes, queries a zone, and acts only if state has changed beyond a threshold. Lightweight, governed, continuous intelligence - without standing access to the estate or a persistent agent session.
What OneIQ ICG enables
- Continuous monitoring without a standing agent session
- Actions triggered by governed estate state, not raw telemetry
- Any orchestration platform can integrate via MCP
- No new attack surface - OneIQ ICG is read-only and customer-controlled
How to integrate
OneIQ ICG is an infrastructure context gateway with an MCP interface. If your platform speaks MCP, it can use a zone.
Any autonomous system, orchestration platform, or agentic framework that supports the Model Context Protocol can connect to OneIQ ICG and query a zone. OneIQ supplies the governed infrastructure intelligence - your platform supplies the execution logic.
Microsoft Copilot
Talk to your infrastructure, right inside Copilot.
Your organization already approved AI, standardized on Microsoft Copilot, and paid for the capacity. OneIQ ICG connects that Copilot to your infrastructure estate through a standard MCP connection - no new AI tool to review, and a fraction of the Copilot Credits a generic agent would burn.
The Copilot you already trust, now answering for infrastructure.
OneIQ registers as a standard MCP connection inside Copilot Studio. Ask "which VMs are oversubscribed" or "price the finance cluster in Azure at a three-year term" in Teams or Copilot Chat, and get a governed, answer-shaped response back in seconds - not a data dump for the model to search.
What it enables
- Copilot Studio capacity your teams actually use, instead of letting credits expire
- Standing infrastructure questions answered on demand, in Teams or Copilot Chat
- No new AI vendor for the security team to review - Copilot stays the interface
- Channel Partners: a workload that makes the Copilot Studio capacity pack sell, and renew