Fabric Real-Time Intelligence + Eventhouse: Enterprise Streaming Architecture for Logistics, Manufacturing, and Finance

TL;DR

• Microsoft Fabric Real-Time Intelligence consolidates the streaming-data capabilities Microsoft previously offered through separate Azure services (Stream Analytics, Data Explorer, Event Hubs) into a unified Fabric workload.
• The architecture's core components are: Eventstream (ingestion), Eventhouse (storage with KQL Database), Real-Time Dashboard (visualization), Data Activator (action triggers), and Real-Time Hub (the central registry).
• For logistics and supply chain, the architecture supports vehicle telemetry, package tracking, and warehouse operational dashboards with sub-minute latency.
• For manufacturing, the architecture supports OEE (Overall Equipment Effectiveness) dashboards, defect detection, and predictive maintenance.
• For financial services, the architecture supports trading dashboards, fraud detection, and AML transaction monitoring.
• This guide details the architecture, the workload patterns, and the EPC Group implementation framework.

Executive Summary

For most of the past decade, Microsoft's streaming analytics capability has been spread across separate services: Azure Stream Analytics for SQL-style streaming queries, Azure Event Hubs for ingestion, Azure Data Explorer for high-volume time-series and log analytics, and various Azure Functions and Logic Apps for action triggers. Each service was capable; the integration burden fell on the architect.

Microsoft Fabric Real-Time Intelligence consolidates these capabilities into a unified workload. The result: streaming data flows through Eventstream into Eventhouse (a KQL Database), is visualized in Real-Time Dashboards, and triggers actions through Data Activator. The Real-Time Hub provides the registry for all streaming sources.

For enterprises with substantive streaming workloads — logistics, manufacturing, financial services, observability — Fabric Real-Time Intelligence is materially easier to implement and operate than the previous architectural pattern. This guide details the architecture and the implementation pattern.

The Architecture Components

Eventstream (Ingestion)

Eventstream is the streaming-data ingestion service. Sources include:

• Azure Event Hubs and Apache Kafka topics.
• Custom apps writing through SDKs.
• Sample data sources for development.
• Custom endpoints with adapters for industry protocols (MQTT for IoT, OPC UA for industrial).

Eventstream supports transformations during ingestion (filtering, aggregation, enrichment with reference data) before the data lands in storage.

Eventhouse (Storage)

Eventhouse provides KQL Database storage for streaming data. KQL (Kusto Query Language) is the query language Microsoft has used for Azure Data Explorer and Log Analytics; it is purpose-built for time-series and event data.

KQL Database features:

• Columnar storage with high compression.
• Time-series-native query patterns.
• Geospatial query support.
• Full-text search.
• Materialized views for pre-aggregated query patterns.

Retention can range from hot tier (queryable instantly) to cold tier (slower but cheaper) per the customer's retention policy.

Real-Time Dashboard

Real-Time Dashboard provides KQL-driven visualizations refreshing on sub-minute cadences. Common patterns:

• Operational dashboards for control rooms (logistics dispatch, manufacturing operations).
• Executive views with real-time KPI tracking.
• Investigative analyses for incidents.

Data Activator

Data Activator monitors streaming data against rules and triggers actions when rules fire. Common actions:

• Email or Teams notification.
• Power Automate flow trigger.
• Webhook to an external system.
• Custom Logic App invocation.

Data Activator is the alternative to Power Automate-only alerting patterns. Where Power Automate connects broadly but operates on per-event evaluation, Data Activator observes continuous streams natively.

Real-Time Hub

Real-Time Hub is the central registry for all streaming sources in the tenant. Sources registered in the Hub are discoverable across the Fabric tenant; permissions and lineage are managed through the Hub.

Workload Patterns

Logistics and Supply Chain

A logistics operator with 5,000 vehicles ingests GPS, telemetry, and event data from each vehicle every minute. The architecture:

1. Vehicle telematics platforms publish to Azure Event Hubs.
2. Eventstream ingests into Eventhouse with light transformation.
3. Real-Time Dashboard visualizes fleet position, delivery status, and exception conditions.
4. Data Activator alerts dispatchers when SLA-threatened deliveries or vehicle issues occur.

Sub-minute latency from event to dashboard.

Manufacturing

A manufacturing operation with 200 machines on a shop floor ingests OEE (Overall Equipment Effectiveness), defect, and predictive-maintenance signals continuously. The architecture:

1. PLCs and SCADA systems publish through MQTT or OPC UA.
2. Eventstream ingests with appropriate protocol adapter.
3. Eventhouse stores time-series data.
4. Real-Time Dashboard provides OEE views by machine, line, and shift.
5. Data Activator triggers maintenance work orders when predictive-maintenance signals fire.

Financial Services

Trading operations ingest order, execution, and market-data events continuously. The architecture:

1. OMS publishes trade events through Kafka or Event Hubs.
2. Eventstream ingests with enrichment from reference data.
3. Eventhouse stores intraday detail.
4. Real-Time Dashboard provides P&L attribution, position, and risk dashboards.
5. Data Activator triggers alerts on limit breaches.

For AML use cases, transaction streams flow into Eventhouse, are analyzed by KQL queries (often with embedded ML), and trigger alerts for suspicious patterns.

When to Use Real-Time Intelligence vs Alternative Patterns

Workload	Real-Time Intelligence wins	Alternative wins
<5-minute latency required	Yes	No
>100K events/hour	Yes	No
Time-series-heavy queries	Yes	No
Geospatial queries on streaming data	Yes	No
Simple Power BI dashboards on slowly-changing data	No	Direct Lakehouse
Batch overnight ETL	No	Fabric Data Factory + Lakehouse
Complex DAX patterns over historical data	No	Power BI semantic model
One-time analytical queries	No	Fabric Warehouse

Capacity Sizing

Real-Time Intelligence consumes Fabric capacity for ingestion (Eventstream), storage and query (Eventhouse), visualization (Real-Time Dashboard), and rules evaluation (Data Activator). The capacity-consumption pattern is continuous, unlike batch workloads.

Sizing guidelines:

Workload	Capacity starting point
Pilot, <10K events/hour	F4
Production small, 10K–100K events/hour	F8
Production medium, 100K–1M events/hour	F16-F32
Production large, 1M–10M events/hour	F32-F64
Production very large, 10M+ events/hour	F64+ or multi-capacity

Validate against the Fabric Capacity Metrics app during pilot.

Implementation Framework

For an enterprise implementing Fabric Real-Time Intelligence, EPC Group's standard pattern:

Weeks 1–3: Architecture.

• Current-state streaming inventory.
• Source-system assessment.
• Architecture design.
• Capacity sizing estimate.

Weeks 4–8: Foundation.

• Fabric F-SKU provisioning.
• Eventstream source connections.
• Eventhouse KQL Database design.
• Initial Real-Time Hub registration.

Weeks 9–14: Use case implementation.

• Priority use cases (typically 3–5) implemented.
• Real-Time Dashboards developed.
• Data Activator rules deployed.

Weeks 15–18: Adoption and stabilization.

• User training.
• Operational runbooks.
• Capacity tuning.
• Documentation handover.

The 18-week pattern is for a substantial implementation with multiple use cases. Single-use-case implementations run shorter.

Common Pitfalls

1. Under-sizing capacity for the continuous workload. Streaming consumes capacity 24/7 in a way batch workloads do not.
2. Treating KQL as if it's SQL. KQL is purpose-built for time-series; using SQL-style patterns underperforms.
3. Over-relying on Data Activator for action. Data Activator triggers actions; the downstream action surface needs design.
4. Skipping retention policy design. Streaming data accumulates fast; without retention policy, storage costs surprise.
5. Mixing Real-Time and batch workloads on the same capacity without planning. Capacity isolation matters more for streaming than for batch.

Frequently Asked Questions

What is Microsoft Fabric Real-Time Intelligence?

Microsoft Fabric Real-Time Intelligence is the unified streaming analytics workload in Fabric, consolidating capabilities Microsoft previously offered through separate services (Azure Stream Analytics, Azure Data Explorer, Azure Event Hubs) into a single integrated experience.

What is Eventhouse?

Eventhouse is the storage layer for Real-Time Intelligence, providing KQL Database storage optimized for time-series and event data. KQL Database supports high-volume ingestion, columnar compression, and time-series-native query patterns.

What is Data Activator?

Data Activator is the rules-engine in Real-Time Intelligence that observes streaming data and triggers actions when defined rule conditions are met. It is positioned for cases where streaming latency matters and where Power Automate alone is insufficient.

When should I use Real-Time Intelligence vs batch Fabric?

Real-Time Intelligence wins when latency is <5 minutes and event volume is high (>10K events/hour). Batch Fabric wins when latency tolerance is >1 hour or when the workload is intermittent. Both can coexist on the same Fabric tenant.

Is KQL hard to learn?

KQL has a steeper learning curve than SQL for teams unfamiliar with it but is straightforward for teams that have used Azure Data Explorer or Log Analytics. EPC Group's standard implementations include KQL training for the customer's team.

What are typical Real-Time Intelligence use cases?

Logistics fleet tracking, manufacturing OEE dashboards, financial services trading dashboards and AML monitoring, observability and security event monitoring, IoT analytics across many industries.

How does Real-Time Intelligence integrate with Power BI?

KQL Database can be a Power BI data source. Power BI semantic models can be built on Eventhouse data with DirectQuery or DirectLake for the historical detail, and Real-Time Dashboards complement the Power BI experience for sub-minute use cases.

What is the typical capacity sizing for Real-Time Intelligence?

Sizing depends on event volume. Pilot workloads start at F4; production workloads typically run at F8–F32 depending on event rate. Very large workloads (10M+ events/hour) may require F64+ or multi-capacity architectures.

Can Real-Time Intelligence handle IoT workloads?

Yes. Eventstream supports IoT protocol adapters (MQTT, OPC UA) and integrates with Azure IoT Hub for managed IoT scenarios.

What is the relationship between Real-Time Intelligence and Azure Data Explorer?

Eventhouse uses the same KQL engine that powers Azure Data Explorer. Customers with existing Azure Data Explorer investments can migrate to Eventhouse or maintain hybrid architectures with shortcuts.

How does Real-Time Intelligence handle retention?

Eventhouse supports hot and cold tier retention with policies per table. Hot tier provides instant query; cold tier provides cheaper long-retention with longer query latency.

How does Real-Time Intelligence handle compliance?

Compliance frameworks apply to Real-Time Intelligence the same way they apply to other Fabric workloads. Sensitivity labels, audit log routing, and access controls all integrate.

How does EPC Group support Real-Time Intelligence implementations?

EPC Group works with enterprises on Real-Time Intelligence implementations across logistics, manufacturing, financial services, and other streaming-heavy industries. The standard engagement is 18 weeks. Our consultants — including Microsoft Press bestselling author Errin O'Connor — bring direct streaming-analytics experience.

What is the typical cost profile for Real-Time Intelligence?

Cost depends on event volume, retention pattern, and query workload. The dominant cost components are Fabric capacity (continuous), storage (volume-based), and the data engineering work to set up and maintain the pipelines.

Can Real-Time Intelligence support edge analytics?

Yes, through Azure IoT Edge integration. Edge devices can run lightweight analytics locally and stream summary data to Eventhouse for enterprise-level aggregation and analysis.

Next Steps

If your enterprise has streaming-heavy workloads or is evaluating real-time analytics architectures, the practical next steps:

1. Inventory current streaming sources and their volume profiles.
2. Identify the priority use cases requiring <5-minute latency.
3. Pilot a single use case to validate the architecture.
4. Plan the capacity sizing and operational model.
5. Engage a partner with deep Real-Time Intelligence experience.

EPC Group has been delivering enterprise Microsoft consulting since 1997 and is Microsoft Solutions Partner with the core designations. We were historically the Microsoft Gold Partner through the program's retirement. Our consultants — including Microsoft Press bestselling author Errin O'Connor — bring direct Real-Time Intelligence implementation experience across industries. To discuss your real-time analytics requirement, contact EPC Group for a 30-minute discovery call.