Summary
Details
Updated January 26, 2026: We have updated the content. Thank you for your patience.
[Introduction]
We’re retiring the Microsoft Defender for Endpoint (MDE) Advanced Hunting API and Microsoft Defender XDR Advanced Hunting API and transitioning customers to the Microsoft Graph Security API. This update aligns our security integrations with a unified interface and schema across Microsoft Defender products. The Microsoft Graph Security API provides broader data coverage, improved consistency, and better scalability for automation and security workflows.
[When this will happen]
- Retirement start: February 6, 2026
- Full retirement: February 1, 2027
- After February 1, 2027, the MDE and XDR APIs will no longer function.
[How this affects your organization]
Who is affected:
- Organizations using the MDE or XDR Advanced Hunting API for automation, integration, or custom workflows.
- You are receiving this message because our reporting indicates your organization may be using these APIs.
What will happen:
- The MDE and XDR Advanced Hunting APIs will stop functioning after February 1, 2027.
- Existing scripts, automations, and workflows that rely on these APIs will fail if not updated.
- The Microsoft Graph Security API will be the supported API for accessing Microsoft security data.
- No automatic migration will occur; manual updates will be required.
[What you can do to prepare]
- Migrate all existing API workflows to the Microsoft Graph Security API by January 31, 2027.
- Update internal documentation, automation scripts, and integration endpoints to use the Microsoft Graph Security API.
- Communicate these changes to your security operations, engineering, and development teams.
- Review Microsoft documentation to plan your migration: Use the Microsoft Graph security API.
- If your organization uses custom solutions, validate that new queries and response schemas work as expected before the retirement date.
Learn more:
- Advanced hunting - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- Migrate from the older APIs - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- (to be retired) Advanced Hunting API - Microsoft Defender for Endpoint | Microsoft Learn
- (to be retired) Microsoft Defender XDR advanced hunting API - Microsoft Defender XDR | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Change History
Updated January 26, 2026: We have updated the content. Thank you for your patience.
[Introduction]
We’re retiring the Microsoft Defender for Endpoint (MDE) API and XDR Advanced Hunting API and transitioning customers to the Microsoft Graph Security API. This update aligns our security integrations with a unified interface and schema across Microsoft Defender products. The Microsoft Graph Security API provides broader data coverage, improved consistency, and better scalability for automation and security workflows.
[When this will happen]
- Retirement start: February 6, 2026
- Full retirement: February 1, 2027
- After February 1, 2027, the MDE and XDR APIs will no longer function.
[How this affects your organization]
Who is affected:
- Organizations using the MDE or XDR Advanced Hunting API for automation, integration, or custom workflows.
- You are receiving this message because our reporting indicates your organization may be using these APIs.
What will happen:
- The MDE and XDR Advanced Hunting APIs will stop functioning after February 1, 2027.
- Existing scripts, automations, and workflows that rely on these APIs will fail if not updated.
- The Microsoft Graph Security API will be the supported API for accessing Microsoft security data.
- No automatic migration will occur; manual updates will be required.
[What you can do to prepare]
- Migrate all existing API workflows to the Microsoft Graph Security API by January 31, 2027.
- Update internal documentation, automation scripts, and integration endpoints to use the Microsoft Graph Security API.
- Communicate these changes to your security operations, engineering, and development teams.
- Review Microsoft documentation to plan your migration: Use the Microsoft Graph security API.
- If your organization uses custom solutions, validate that new queries and response schemas work as expected before the retirement date.
Learn more:
- Advanced hunting - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- Migrate from the older APIs - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- (to be retired) Advanced Hunting API - Microsoft Defender for Endpoint | Microsoft Learn
- (to be retired) Microsoft Defender XDR advanced hunting API - Microsoft Defender XDR | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Updated January 26, 2026: We have updated the content. Thank you for your patience.
[Introduction]
We’re retiring the Microsoft Defender for Endpoint (MDE) Advanced Hunting API and Microsoft Defender XDR Advanced Hunting API and transitioning customers to the Microsoft Graph Security API. This update aligns our security integrations with a unified interface and schema across Microsoft Defender products. The Microsoft Graph Security API provides broader data coverage, improved consistency, and better scalability for automation and security workflows.
[When this will happen]
- Retirement start: February 6, 2026
- Full retirement: February 1, 2027
- After February 1, 2027, the MDE and XDR APIs will no longer function.
[How this affects your organization]
Who is affected:
- Organizations using the MDE or XDR Advanced Hunting API for automation, integration, or custom workflows.
- You are receiving this message because our reporting indicates your organization may be using these APIs.
What will happen:
- The MDE and XDR Advanced Hunting APIs will stop functioning after February 1, 2027.
- Existing scripts, automations, and workflows that rely on these APIs will fail if not updated.
- The Microsoft Graph Security API will be the supported API for accessing Microsoft security data.
- No automatic migration will occur; manual updates will be required.
[What you can do to prepare]
- Migrate all existing API workflows to the Microsoft Graph Security API by January 31, 2027.
- Update internal documentation, automation scripts, and integration endpoints to use the Microsoft Graph Security API.
- Communicate these changes to your security operations, engineering, and development teams.
- Review Microsoft documentation to plan your migration: Use the Microsoft Graph security API.
- If your organization uses custom solutions, validate that new queries and response schemas work as expected before the retirement date.
Learn more:
- Advanced hunting - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- Migrate from the older APIs - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- (to be retired) Advanced Hunting API - Microsoft Defender for Endpoint | Microsoft Learn
- (to be retired) Microsoft Defender XDR advanced hunting API - Microsoft Defender XDR | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
[Introduction]
We’re retiring the Microsoft Defender for Endpoint (MDE) API and XDR API and transitioning customers to the Microsoft Graph Security API. This update aligns our security integrations with a unified interface and schema across Microsoft Defender products. The Microsoft Graph Security API provides broader data coverage, improved consistency, and better scalability for automation and security workflows.
[When this will happen]
- Retirement start: February 6, 2026
- Full retirement: February 1, 2027
- After February 1, 2027, the MDE and XDR APIs will no longer function.
[How this affects your organization]
Who is affected:
- Organizations using the MDE API or XDR API for automation, integration, or custom workflows.
- You are receiving this message because our reporting indicates your organization may be using these APIs.
What will happen:
- The MDE and XDR APIs will stop functioning after February 1, 2027.
- Existing scripts, automations, and workflows that rely on these APIs will fail if not updated.
- The Microsoft Graph Security API will be the supported API for accessing Microsoft security data.
- No automatic migration will occur; manual updates will be required.
[What you can do to prepare]
- Migrate all existing API workflows to the Microsoft Graph Security API by January 31, 2027.
- Update internal documentation, automation scripts, and integration endpoints to use the Microsoft Graph Security API.
- Communicate these changes to your security operations, engineering, and development teams.
- Review Microsoft documentation to plan your migration: Use the Microsoft Graph security API.
- If your organization uses custom solutions, validate that new queries and response schemas work as expected before the retirement date.
Learn more:
- Advanced hunting - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- Migrate from the older APIs - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- (to be retired) Microsoft Defender for Endpoint (MDE) API
- (to be retired) Microsoft Defender XDR API
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Updated January 26, 2026: We have updated the content. Thank you for your patience.
[Introduction]
We’re retiring the Microsoft Defender for Endpoint (MDE) API and XDR Advanced Hunting API and transitioning customers to the Microsoft Graph Security API. This update aligns our security integrations with a unified interface and schema across Microsoft Defender products. The Microsoft Graph Security API provides broader data coverage, improved consistency, and better scalability for automation and security workflows.
[When this will happen]
- Retirement start: February 6, 2026
- Full retirement: February 1, 2027
- After February 1, 2027, the MDE and XDR APIs will no longer function.
[How this affects your organization]
Who is affected:
- Organizations using the MDE or XDR Advanced Hunting API for automation, integration, or custom workflows.
- You are receiving this message because our reporting indicates your organization may be using these APIs.
What will happen:
- The MDE and XDR Advanced Hunting APIs will stop functioning after February 1, 2027.
- Existing scripts, automations, and workflows that rely on these APIs will fail if not updated.
- The Microsoft Graph Security API will be the supported API for accessing Microsoft security data.
- No automatic migration will occur; manual updates will be required.
[What you can do to prepare]
- Migrate all existing API workflows to the Microsoft Graph Security API by January 31, 2027.
- Update internal documentation, automation scripts, and integration endpoints to use the Microsoft Graph Security API.
- Communicate these changes to your security operations, engineering, and development teams.
- Review Microsoft documentation to plan your migration: Use the Microsoft Graph security API.
- If your organization uses custom solutions, validate that new queries and response schemas work as expected before the retirement date.
Learn more:
- Advanced hunting - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- Migrate from the older APIs - Use the Microsoft Graph security API | Microsoft Graph | Microsoft Learn
- (to be retired) Advanced Hunting API - Microsoft Defender for Endpoint | Microsoft Learn
- (to be retired) Microsoft Defender XDR advanced hunting API - Microsoft Defender XDR | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Never Miss a Microsoft 365 Update
Join thousands of IT professionals who rely on DeltaPulse for real-time Microsoft 365 change intelligence, automated notifications, and community insights.