Edit

Microsoft Graph what's new history

Find information about previous additions and updates to Microsoft Graph APIs, documentation, SDKs, and other resources.

June 2026: New and generally available

Applications | Service principal

Evaluate applications in the Microsoft Entra application gallery by using the applicationTemplate resource type, including the riskScore and riskFactors properties for risk assessment.

Files

Groups

  • Added the accessType, isFavorite, unseenConversationsCount, and unseenMessagesCount properties to the group resource. Use these properties to manage access settings and track conversation activity for Microsoft 365 groups. Added the groupAccessType enumeration type to support the accessType property on the group resource.

Identity and access | Governance

  • Added the type property to the accessPackageResourceRole resource to indicate whether an Azure resource role is active or eligible, enabling PIM-based role assignments for Azure resources in access packages.
  • Added the accessPackageSuggestion resource type and related methods for discovering suggested access packages based on related people insights and assignment history. Use the filterByCurrentUser function to retrieve personalized suggestions.
  • Added the approverInformationVisibility property to the accessPackageApprovalStage resource to control whether approver information is visible to requestors.
  • Added the endUserSettings resource type and related methods for configuring access package suggestion behavior, including related people insight levels and approver detail visibility.

Identity and access | Identity and sign-in

Added support for programmatic FIDO2 passkey registration. Use the creationOptions function to get WebAuthn credential creation options, then complete registration by posting the new publicKeyCredential property to the fido2AuthenticationMethod resource.

People and workplace intelligence

  • Updated the Manage profile source precedence in Microsoft 365 topic to clarify supported data sources for HR and work position data, explain how source precedence affects single-value versus multi-value properties, and add guidance on correctly configuring and removing tenant-level settings using the Microsoft Graph API or PowerShell.
  • Added the People data sources in Microsoft 365 concept article that describes the data sources that build the Microsoft 365 user profile, including Microsoft Entra ID, Copilot connectors, Organizational data, SharePoint, People Skills, user edits, and the API user source. The article also provides a reference table of built-in source IDs (GUIDs) and explains how source metadata appears in the profile API output.

Security | eDiscovery

Teamwork and communications | Calls and online meetings

Updated Microsoft Graph documentation for transcript APIs to add guidance on tenant administrator controls that govern transcript access and speaker attribution. For more information, see Get change notifications for transcripts and recordings using Microsoft Graph.

Teamwork and communications | Shift management

The timeZone property of the schedule resource must be set to an IANA time zone name, such as America/Chicago or Europe/London. For more information, see Create or replace schedule.

Users

Application permissions for the user: translateExchangeIds API are supported only for request URLs that identify a user in the path.

June 2026: New in preview only

Agents | Agent identities

  • Added the appRoleAssignmentRequired property to the agentIdentity resource. This property indicates whether users or service principals must be explicitly granted an app role assignment before they can access the agent identity.

Applications | Service principal

Backup and recovery | Microsoft 365 Backup and Storage

  • Added support for full workload backup APIs to protect entire Microsoft 365 workloads (SharePoint Online, OneDrive for work or school, and Exchange Online) with minimal administrative overhead. Create a protection policy that backs up all data in a workload and specify only the items to exclude from backup. For more information, see exclusionUnitBase.
  • Deprecated the queryExpression property on the artifactQuery resource. Use the structuredQueryExpression property instead to create structured search queries.
  • Added the error property of type publicError to the granularRestoreArtifactBase resource and its derived types. Use this property to get error details when a granular restore operation for an individual artifact fails or completes with an error.

Device and app management | Cloud PC

  • Use the cloudPcProvisioningPolicy: apply method to apply policy settings such as region and singleSignOn. This method also supports reprovisioning for frontline shared mode Cloud PCs by using the reservePercentage parameter to control the percentage of Cloud PCs that remain available during the process.
  • Use the lastLogoffDateTime property on cloudPC to get the date and time when the user last logged off from the Cloud PC session.
  • Retrieve the pending apply status of a provisioning policy to determine whether unapplied changes exist for Cloud PCs.
  • Use the isForceUserLogoffEnabled parameter and property on cloudPcProvisioningPolicy: apply and cloudPcPolicyScheduledApplyActionDetail to indicate whether active Cloud PC sessions are forcibly signed out when reprovisioning begins.
  • Deprecated the notificationSetting property on the cloudPcUserSetting resource. This property will stop returning data on July 14, 2026.

Device and app management | Device updates

Added the updateCategoryEnrollmentInformation resource type to manage per-category enrollment state for Windows Updates. Use it to track enrollment state changes across update categories and access the current enrollment configuration through the updateManagementEnrollment and azureADDevice resources.

Files

Identity and access | Directory management

Added redirect URI validation and restriction capabilities to tenant app management policies, allowing tenant administrators to control redirect URI schemes, domains, and wildcard usage. Use the redirectUris property -> redirectUriConfiguration resource and its associated configuration resources to manage these restrictions through the appManagementApplicationConfiguration and customAppManagementApplicationConfiguration resources.

Identity and access | Governance

Identity and access | Identity and sign-in

  • Added the callerIdNumber property to the voiceAuthenticationMethodConfiguration resource. Use this property to configure the phone number displayed as the caller ID when voice call authentication is initiated.
  • Added updated identity fields to the agentRiskDetection resource type to make it easier to identify the associated identity in agent risk detections. Deprecated the legacy agent identity properties; they will be removed after 2027-04-28.

Mail

Use the user configuration API in Microsoft Graph to build solutions that store and retrieve per-folder configuration data alongside Exchange Online mailbox content.

People and workplace intelligence | Places

Manage the service plans associated with workspace desks and use a consistent placeId identifier across place types.

Reports | Identity and access reports

Added the identityAnalyticsRoot resource type to provide point-in-time identity analytics for your tenant, starting with analytics about your groups such as their membership, ownership, and type.

  • Added the informationProtectionLabel property to the externalItem resource to specify the Microsoft Purview sensitivity label associated with an external item.
  • Introduced programmatic management of personal distribution lists in user mailboxes through the distributionList and distributionListMember resource types. You can now:
    • Create, read, update, and delete distribution lists in a user's mailbox
    • Add and remove members from distribution lists
    • Retrieve expanded member information with resolved contact details and recipient types
    • List all distribution lists owned by a user
  • Personal distribution lists enable users to group email recipients together and send messages to all members at once without entering each address individually.

Security | Advanced hunting

Security | Alerts and incidents

Security | Audit log query

Expanded audit log coverage with 28 new auditData derived types and corresponding auditLogRecordType enumeration members. Query audit events for AI and Copilot services (Dragon Copilot, Security Copilot, Copilot session sharing), security and compliance workloads (Defender for AI, threat submission entities, compliance policy grading), and productivity services (Fabric policy, Viva Glint campaigns, Azure AI Search, Teams user concerns, Spark Core). Added the dynamicProperties property of type auditRecordTypeDictionary to enable access to workload-specific audit event properties.

Security | Custom detection rules

Updated the custom detection rules API in Microsoft 365 Defender with new capabilities, including: Infrastructure-as-code (IaC) support through user-defined IDs, custom run frequency, flexible entity mapping, custom alert details, and configurable response actions.

Security | Data security and compliance

Added the policyTipAction resource type and the policyTip member to the dlpAction enumeration. This enables applications to receive policy tip guidance as a standalone action when DLP policies are triggered through the processContent and protectionScopes APIs.

Security | eDiscovery

Added the cloudNativeHtmlConversion member to the additionalDataOptions enumeration.

Security | Email and collaboration protection

  • Use the analyzedEmail resource type and its associated methods to give Security Operations teams direct, near real-time access to query email threats, indicators of compromise (IOCs), attack vectors, and evidence in a tenant. Email metadata, verdict information, related underlying entities such as attachments and URLs, filters, and timeline events are returned to support investigation and response.
  • List analyzedEmails under the collaboration root to retrieve email records for a time range with support for $filter, $top, $count, and $skiptoken.
  • Get analyzedEmail to read the properties of a specific email, including its attachments, URLs, threat detection details, and timeline events.
  • analyzedEmail: remediate to trigger purge actions (move to junk, move to Inbox, soft delete, hard delete, move to deleted items, move to quarantine) for SOAR integrations, playbooks, and automations.

Security | Identities

Introduced sensor migration capabilities to migrate eligible Microsoft Defender for Identity sensors.

Sites and lists

  • Added the isSearchable property to the columnDefinition resource type to enable independent control of the searchable state of a column, separate from the indexed property. This property is currently supported only for columns in a fileStorageContainer.
  • Added the sharePointReportSettings resource type and related methods for managing SharePoint API usage report metrics. Use the enableApiUsageReport and disableApiUsageReport methods to control which metrics are collected and reported for your tenant.

Teamwork and communications | Calls and online meetings

Teamwork and communications | Messaging

Add a Viva Engage community to a section. You can provide either the bare community ID returned when you list communities (for example, eyJfdHlwZSI6Ikdyb3VwIiwiaWQiOiIxOTAzMzYyMTIyMTAifQ) or the full 19:{communityId}@EngageCommunity thread ID. When you provide a bare community ID, the service automatically normalizes it to the 19:{communityId}@EngageCommunity format; an ID that already includes the thread prefix is used as-is.

Teamwork and communications | Shift management

The timeZone property of the schedule resource must be set to an IANA time zone name, such as America/Chicago or Europe/London. For more information, see Create or replace schedule.

Tenants | Cross-tenant migration

Validate and migrate a cross-tenant migration job asynchronously. A previously created job must pass validation before migration can start.

Tenants | Tenant governance

Added the groupDisplayName property to the delegatedAdministrationRoleAssignment and delegatedAdministrationRoleAssignmentSnapshot resources. This property surfaces the display name of the security group inline, so consumers don't need to make a separate Microsoft Graph /groups/{id} call to resolve it.

Users

Application permissions for the user: translateExchangeIds API are supported only for request URLs that identify a user in the path.

May 2026: New and generally available

Agents

  • Added the agentUser resource type and related methods for managing the lifecycle of agent user identities.
  • Added the verifiedIdProfile resource type and related profile configuration for configuring Microsoft Entra Verified ID.

Backup storage

Added the emailNotificationsSetting resource and its associated methods to configure multi-admin email notifications for Microsoft 365 Backup Storage, including which administrators or custom recipients receive notifications and which event types they're notified about.

Files

Groups

Added the ownerlessGroupPolicy resource type and related methods to the v1.0 endpoint. Use this policy to configure actionable email notifications that prompt active members of ownerless Microsoft 365 groups to accept ownership when the sole owner leaves the organization or their account is disabled.

Identity and access | Directory management

  • Use the deviceRegistrationPolicy resource type and its related methods to manage the policy that controls device registration quota restrictions, additional authentication, and authorization policies for your Microsoft Entra tenant.

Identity and access | Governance

Added the previewFailedTask resource type and the previewTaskFailures and previewWorkflow methods to the workflow resource type to support workflow preview operations in Lifecycle Workflows. Also added the previewScope relationship to the workflow resource type and the preview member to the workflowExecutionType enumeration type.

Identity and access | Identity and sign-in

  • Added the onVerifiedIdClaimValidationCustomExtension and onVerifiedIdClaimValidationListener resource types and associated methods to support custom logic for claim validation from Verified ID credential presentations during authentication flows through Microsoft Entra custom authentication extensions in External ID.
  • Added claim validation and match-confidence capabilities to Verified ID profiles, enabling stronger claim verification and more flexible matching.
  • Enhanced the x509CertificateAuthenticationMethodConfiguration resource type with the following capabilities for certificate-based authentication (CBA):
    • Scoping CBA to specific certificate authorities and restrict which groups of users can authenticate using certificates from those CAs.
    • Controlling whether issuer hints are sent to the client to filter the certificates shown in the certificate picker.
  • Updated the targetedAuthenticationMethod property of the authenticationMethodsRegistrationCampaignIncludeTarget resource to support Fido2 in addition to microsoftAuthenticator for authentication method registration campaigns. Organizations can now use registration campaigns to nudge users to register and sign in with phishing-resistant passkeys (FIDO2).

Mailbox import and export

Use the mailbox import and export APIs in Microsoft Graph to build solutions that integrate with mailbox resources for data import and export scenarios. For more information, see Overview of the mailbox import and export APIs in Microsoft Graph.

People and workplace intelligence | People admin settings

Use the isVisible property on profileCardProperty to indicate whether the given directory property should be shown on a user's profile card.

Security | Alerts and incidents

  • Added the migration guide Migrate from legacy alerts to the alerts and incidents API to help you transition your apps from the deprecated Microsoft Graph security alerts v1 API to the new alerts and incidents API.
  • Extended the alertEvidence base type with additional derived types to provide detailed context about various artifacts involved in security alerts.
  • Added support for the microsoftSecurityForAI service source for security alerts.
  • Added the categories property to the alert resource.
  • Deprecated the category property on the alert resource. Use the categories property instead.

Teamwork and communications | Messaging

Teamwork and communications | Shifts

Supports additional theme colors in the scheduleEntityTheme enumeration for the theme property on openShiftItem, shiftItem, shiftActivity, and timeOffItem.

May 2026: New in preview only

Device and app management | Cloud PC

Files

Identity and access | Governance

Added the approverDelegate and identityGovernanceUserSettings resources to enable users to delegate their approval responsibilities for access package approvals and access reviews.

Identity and access | Identity and sign-in

People and workplace intelligence | People admin settings

Use the isVisible property on profileCardProperty to indicate whether the given directory property should be shown on a user's profile card.

People and workplace intelligence | Photo update settings

Use the List and Update methods as the only operations for the photoUpdateSettings to get and update the photoUpdateSettings properties.

Reports | Identity and access reports

Security | Advanced hunting

Added the getHuntingSchema method to the security resource to retrieve the available tables, columns, and functions for Microsoft Defender XDR advanced hunting queries.

Security | Alerts and incidents

Security | Case management

  • Added the caseManagement relationship to the security resource and related APIs to help security teams create and manage investigation cases, including tasks, activities, relations, and attachments.

Security | Data security and compliance

Added the contentActivityMetadata resource to represent and track Data Loss Prevention (DLP) enforcement result metadata for content entries, including identifiers, timestamps, and policy statuses.

Teamwork and communications | Apps

Use the scopeInfo property on teamsAppInstallation to get the details of the scope in which the app is installed.

Teamwork and communications | Calls and online meetings

  • Use the virtualEventTownhallRegistrationConfiguration resource to manage attendee access for town halls and enable more controlled, scalable audience management.
  • Added the capacity property to virtual event town hall. This property allows customers to specify the expected attendee size when creating or updating a town hall or session and retrieve it later. Validation ensures compliance with SKU and licensing limits, returning actionable errors when capacity exceeds entitlement.

Teamwork and communications | Messaging

Added support for $expand on the items relationship of the teamworkSection resource to retrieve a section together with its items in a single request.

Tenants | Cross-tenant access

  • Use the sensorTypes property on sensorCandidate to get the list of device types for the sensor.
  • Added the following properties and their associated complex types to the crossTenantAccessPolicyConfigurationDefault and crossTenantAccessPolicyConfigurationPartner resources of cross-tenant access policy APIs to support Microsoft 365 collaboration and app service connect settings:
    • appServiceConnectInbound property to get or set the default or partner-specific configuration for inbound app service connect settings.
    • m365CollaborationInbound property to get or set the default or partner-specific configuration for inbound Microsoft 365 collaboration settings.
    • m365CollaborationOutbound property get or set the default or partner-specific configuration for outbound Microsoft 365 collaboration settings.

April 2026: New and generally available

Applications

Backup storage

Files

Identity and access | Governance

Use approverRemove as a new supported value for the requestType property of the accessPackageAssignmentRequest resource. For more information, see accessPackageAssignmentRequest.

Identity and access | Identity and sign-in

  • Added the verifiableCredentialsAuthenticationMethodConfiguration resource type and related methods to the v1.0 endpoint. Use it to configure verifiable credentials as an authentication method for user sign-in.
  • Added the verifiableCredentialAuthenticationMethodTarget resource type to the v1.0 endpoint. Use it to specify groups and users enabled to use verifiable credentials for authentication.
  • Use riskRemediation as part of conditional access grant controls to enforce a User Risk conditional access policy. When you select "Require risk remediation" in your policy's grant controls, Microsoft Entra ID Protection manages the appropriate remediation flow based on the threat observed and the user's authentication method. In passwordless Risky User sessions, it updates risk details with microsoftRevokedSessions.

Teamwork and communications | Apps

Manage Teams apps at the channel level within a team using the following APIs:

Teamwork and communications | Messaging

  • Removed the model parameters and payment-model guidance from Microsoft Teams export APIs and related change-notification documentation. The model query parameter is no longer required and is ignored if supplied. For more information, see Payment models and licensing requirements for Microsoft Teams APIs.
  • The following Microsoft Teams APIs support @odata.nextLink pagination to handle increased channel limits. When the result set spans multiple pages, the response includes the @odata.nextLink property with a URL for retrieving the next page of results:

April 2026: New in preview only

Agents

Added deprecation notices to the agentRegistry, agentCardManifest, agentCollection, and agentInstance resources and their related operations. These Agent Registry APIs will be replaced by Agent 365-based APIs starting May 1, 2026.

Applications

Added the deprecationDate property to the applicationTemplate resource to indicate when an application will be removed from the Microsoft Entra application gallery.

Backup and recovery

Device and app management | Cloud PC

  • The /me/cloudPCs/{cloudPCId}/getCloudPcLaunchInfo and /users/{userId}/cloudPCs/{cloudPCId}/getCloudPcLaunchInfo endpoints are deprecated and will stop returning data on October 30, 2026. Going forward, use the retrieveCloudPcLaunchDetail API.
  • Added the cloudPcOnPremisesConnectionSubnetIpDetail resource type to represent the subnet IP details of a Cloud PC on-premises connection.
  • Use the subnetPrivateIpDetail property on cloudPcOnPremisesConnection to get detailed information about the subnet's private IP addresses associated with the subnet.

Files

  • Use the height and width query parameters on the driveItem content conversion API to download a file in another format when format=jpg.
  • Use the itemCount property on the list resource to quickly access the total number of items in a SharePoint list without retrieving all items or making additional queries.

Identity and access | Directory management

Added the inheritedAppRoleAssignments and inheritedOauth2PermissionGrants relationships to the agentIdentity resource to retrieve inherited permissions from the parent Agent Identity Blueprint Service Principal.

Identity and access | Governance

Identity and access | Identity and sign-in

Added the blueprintId and source agent-descriptive properties to agentRiskDetection and riskyAgent resources.

Mail

Introduced the new notes API that enables users to create and manage simple notes in their Notes folder. Notes support text content with optional inline image attachments, and are suitable for quick capture scenarios. Use the note resource and the following APIs:

Mailbox import and export

Learn how to handle HTTP redirects when accessing folders and items in archive mailboxes with autoexpanded folders using the mailbox import and export APIs. For more information, see Handle archive mailbox redirects.

People and workplace intelligence | Profile

Use the activities, awards, and fieldsOfStudy properties on educationalActivityDetail to get or set collections of activities, awards, or fields of study.

Reports | Identity and access reports

Added the azureADPremiumLicenseInsight resource and its associated APIs for getting insights into the Microsoft Entra ID P1 and P2 premium license utilization for the tenant, including feature utilization breakdowns for P1, P2, Internet Access, and Private Access features.

Security | Compliance

Updated the capabilities of the auditLogQuery resource type and its associated methods as follows:

  • Updated the auditLogRecordType enumeration to represent over 400 types of audit log operations across Microsoft cloud services.
  • Added 135 new derived types of the auditData resource to represent audit log data for specific services and features, including AI and Copilot interactions, agent management, compliance and data lifecycle management (Microsoft Purview, eDiscovery, DLP), cloud services (Azure Firewall, Microsoft Defender, Sentinel), and collaboration services (Teams, Planner, SharePoint, Viva). For a complete list of audit data types, see auditData derived types.

Security | Microsoft Defender for Identity

Use the sensorTypes property on sensorCandidate to get the list of device types for the sensor.

Teamwork and communications | Messaging

March 2026: New and generally available

Applications

Using the signInAudience property to limit where an application can be used isn't a replacement for proper tenant validation and authorization enforcement in your application code. If your application expects access only in specific tenants, you must enforce that validation in your application code. To learn more, see Secure applications and APIs by validating claims.

Calendars | Places

Device and app management | Cloud PC

Files

Identity and access | Directory management

Introduced the Agent Identity API to support registration and management of AI agents in Microsoft Entra ID. This API enables agent builders and tenant admins to:

The API also introduces supporting types including inheritableScopes, allAllowedScopes, enumeratedScopes, noScopes, and the scopeCollectionKind enumeration.

Added the createdByAppId property to the application and servicePrincipal resources.

Identity and access | Governance

  • Added the allDirectoryAgentIdentities member to the allowedTargetScope enumeration to allow access packages to target all directory agent identities.
  • Added the targetAgentIdentitySponsorsOrOwners resource type that defines the sponsors or owners of a specific agent identity.

Identity and access | Identity and sign-in

  • Added new authentication event resources to support Just-In-Time (JIT) user migration scenarios from legacy authentication systems:
    • Use the onPasswordSubmitListener resource to configure authentication event listeners that trigger during password submission.
    • Use the onPasswordSubmitCustomExtension resource to configure custom extensions that validate passwords against external legacy authentication systems.

People and workplace intelligence | People admin settings

  • Use the new profileSource APIs to enable administrators to customize the display information of a profile source seen by users across an organization in Microsoft 365 experiences.
  • Use the new profilePropertySetting APIs to configure tenant-level settings for profile properties.

Personal contacts

Use the primaryEmailAddress, secondaryEmailAddress, and tertiaryEmailAddress properties on contact to get or set the primary, secondary, or tertiary email address of a contact.

Teamwork and communications | Calls and online meetings

Added ad hoc call support to change notifications for transcripts and recordings in Microsoft Teams. You can now subscribe to the following resources to get notified when a transcript or recording is available for an ad hoc call:

  • communications/adhocCalls/{adhocCallId}/transcripts
  • users/{userId}/adhocCalls/getAllTranscripts
  • communications/adhocCalls/{adhocCallId}/recordings
  • users/{userId}/adhocCalls/getAllRecordings

For more information, see Get change notifications for transcripts and recordings using Microsoft Graph.

Tenants | Configuration management

The new Tenant Configuration Management APIs in Microsoft Graph allow administrators to control and manage configuration settings across a single workload or multiple workloads within an organization. To learn more about supported use cases, see Use the Tenant Configuration Management APIs in Microsoft Graph.

March 2026: New in preview only

Applications

  • Using the signInAudience and signInAudienceRestrictions properties to limit where an application can be used isn't a replacement for proper tenant validation and authorization enforcement in your application code. If your application expects access only in specific tenants, you must enforce that validation in your application code. To learn more, see Secure applications and APIs by validating claims.
  • Added the trafficRoutingMethod property to the onPremisesPublishing resource to control how traffic is distributed across multiple connectors in a connector group in Microsoft Entra app proxy.

Backup storage

  • Use the backupRetentionPeriodInDays property on driveProtectionUnit, mailboxProtectionUnit, and siteProtectionUnit to get the retention period of the backup, in days.
  • Added the includeNewerItems member as supported value for the tags property on restorePoint to get a restore point within a specified time period that includes any newer items created during that period.

Calendars | Places

Device and app management | Cloud PC

Employee experience | Employee engagement

Use the follow user, unfollow user, list followers, and list following APIs for Viva Engage to manage storyline following relationships.

Files

Groups

Added the ownerlessGroupPolicy resource and related API operations to enable IT administrators to configure policies for managing groups that have lost their sole owner. Use this API to send actionable notification emails to active members of ownerless groups to accept ownership.

Identity and access | Directory management

  • Introduced the Entra Backup and Recovery APIs to enable IT administrators to back up and restore Microsoft Entra ID tenant data. You can view snapshots and start preview jobs for analysis before running the recovery jobs. You can also monitor the status of recovery processes including successes and failures. For more information, see Overview of Microsoft Entra Backup and Recovery APIs.
  • Use keyCredentials as a property on appManagementConfiguration to get a collection of certificate restrictions settings to be applied to an application or service principal.
  • Use passwordCredentials as a property on appManagementConfiguration to get a collection of password restrictions settings to be applied to an application or service principal.
  • Use customSecurityAttributes as a property on appManagementPolicyActorExemptions to get a collection of customSecurityAttributeExemption objects to exempt from the policy enforcement.

Identity and access | Governance

Use the administrationScopeTargets relationship on the workflowBase, workflow, and workflowVersion resources to specify the administrative units in the scope of a lifecycle workflow.

Identity and access | Network access

  • Added the homeTenantId, crossTenantAccessType, and deviceJoinType properties to the connection resource to support Bring Your Own Device (BYOD) and Business-to-Business (B2B) collaboration scenarios in Global Secure Access traffic connection logs.
  • Added the crossTenantAccessType enumeration type.
  • Added the deviceJoinType enumeration type.
  • Added the List generativeAIInsights method to retrieve generative AI prompt and MCP activity insights from Global Secure Access traffic logs. Use this method to monitor AI activity patterns, investigate destination context, and correlate user sessions for security and compliance analysis.
  • Added the Cloud Firewall APIs to manage firewall policies, rules, and policy links for Microsoft Entra Global Secure Access. Use the following new resources and their associated APIs:
    • Use the cloudFirewallPolicy resource and its associated methods to create and manage cloud firewall policies.
    • Use the cloudFirewallRule resource and its associated methods to define firewall rules with source and destination matching conditions.
    • Use the cloudFirewallPolicyLink resource and its associated methods to link cloud firewall policies to filtering profiles.

Security | Alerts and incidents

Security | Microsoft Defender for Identities

  • Added migration guidance for Microsoft Defender for Endpoint (MDE) advanced hunting APIs to help organizations transition from the retired APIs that were available through the https://api.securitycenter.microsoft.com endpoint to the advanced hunting APIs available in Microsoft Graph. For more information, see Migrate from the older APIs.
  • The Defender for Identity sensor management APIs let you discover eligible servers, control automatic onboarding, activate or deactivate the unified agent, and manage required auditing settings during activation—all through a single management interface.

Tenants | Tenant governance

Introduced the tenant governance API set to enable organizations to manage and govern relationships with other tenants. Key capabilities include:

  • Activating invitation reception and related tenant discovery
  • Establishing governance relationships between a governing tenant and a governed tenant
  • Tracking established relationships
  • Configure relationship policies

For more information, see Overview of Tenant Governance APIs.

February 2026: New and generally available

External data connections

Added 19 people domain semantic labels to the label enumeration for Microsoft 365 Copilot connectors. These labels enable developers to map people profile data from external systems to standardized Microsoft Graph properties. Use these labels in schema definitions to improve discoverability and integration of people data in Microsoft 365 Copilot experiences. The new labels include: personEmails, personAddresses, personAnniversaries, personName, personNote, personPhones, personCurrentPosition, personWebAccounts, personWebSite, personSkills, personProjects, personAccount, personAwards, personCertifications, personAssistants, personColleagues, personManager, personAlternateContacts, and personEmergencyContacts.

Files

Updated the admin consent requirement for the following delegated permissions related to SharePoint Embedded file storage container management:

  • The FileStorageContainerType.Manage.All delegated permission no longer requires admin consent.
  • The FileStorageContainerTypeReg.Manage.All delegated permission no longer requires admin consent.

Groups

  • Added the resourceBehaviorOptions and resourceProvisioningOptions properties to the group resource. These properties enable you to specify group behaviors and associated resources for a Microsoft 365 group.
  • Added a known issue: For soft deleted security groups, the securityEnabled property returns false instead of true. To identify the group type, use the groupTypes property where ["Unified"] indicates a Microsoft 365 group and an empty array ([]) indicates a security group. For more information, see Get deleted item and List deleted items.

Identity and access | Governance

  • Added the allDirectoryAgentIdentities member to the allowedTargetScope enumeration to allow access packages to target all directory agent identities.
  • Added the targetAgentIdentitySponsorsOrOwners resource type that defines the sponsors or owners of a specific agent identity.

Identity and access | Identity and sign-in

  • QR code authentication method in Microsoft Entra ID lets you manage the QR code authentication method for users, and how they can sign in with a QR code and PIN. The following key resources support this capability:

Mail | Message trace

Use the message trace API to track the flow of email messages through your Exchange Online organization. For more information, see exchangeMessageTrace.

Search

  • Added the principal and principalCollection data types to the externalConnection to specify the data type for people‑related property items in the external connection.
  • Added the description property to the externalConnection properties to allow the addition of a description to the schema properties in the external connection.
  • Added more tags or semantic labels that can be added to labels in the externalConnection property in the external connection schema. Labels help Microsoft 365 Copilot understand the semantics of the data in the connection and provide more relevant results.
  • Added the contentCategory property to the externalConnection to specify the domain category of the content associated with the external connection for improved relevance and ranking.

Security | Data security and compliance

  • Added the labelNotFoundException member to the usageRights enumeration type. This member represents a label with no protection settings, so there are no usage rights to evaluate in Microsoft Purview.
  • Added the restrictWebGrounding member to the dlpAction enumeration to support restricting web grounding actions in data loss prevention policies in Microsoft Purview.

Security | Threat protection

Updated the admin consent requirement for the following delegated permissions related to threat submissions:

  • The ThreatSubmission.Read delegated permission now requires admin consent.
  • The ThreatSubmission.ReadWrite delegated permission now requires admin consent.

Tasks and plans

Added support for chat messaging on Planner tasks, enabling users to create, update, delete, and react to messages directly on tasks. Use the following new resources and APIs:

Teamwork and communications | Administration

February 2026: New in preview only

Applications

Use the requiredResourceAccess property on agentIdentityBlueprint to specify the Microsoft Graph permissions (delegated scopes and app roles) required by the agent.

Applications | Application template

Use the isEntraIntegrated property on applicationTemplate to indicate whether the application is integrated with Microsfot Entra ID (for example, through single sign-on or user provisioning).

Backup storage

Users can now browse a fastRestore endpoint and selectively restore files and folders by creating a browse session.

The granular restore process is designed to be simple and efficient and consists of three main steps:

Device and app management | Cloud licensing

Use the new cloud licensing APIs to manage tenant, user, and group licensing data for Microsoft 365 services. These APIs provide programmatic access to allotments, assignments, assignment errors, subscription lifecycles, and waiting members. For more information, see Use the cloud licensing API in Microsoft Graph (preview).

Files

Identity and access | Directory management

Added the managerApplications property to the application and agentIdentityBlueprint resources to specify applications designated as managers of an application. On the base application resource, this property is read-only for third-party (3P) callers. On the agentIdentityBlueprint resource, manager applications can create agent blueprint principals, agent identities, and agent users for their managed agent blueprints without requiring high-privileged permissions such as AgentIdentityBlueprintPrincipal.ReadWrite.All.

Identity and access | Governance

Added the previewScope relationship, previewTaskFailures method, and previewWorkflow method to the workflow resource to support previewing Lifecycle Workflows before running them in production.

Identity and access | Identity and sign-in

  • Added the agentIdentityType enumeration to represent the type of Microsoft Entra agent identity for risk detection and management. Use the identityType property on the riskyAgent and agentRiskDetection resources to classify different types of agent identities.
  • Added new authentication event resources to support Just-In-Time (JIT) user migration scenarios from legacy authentication systems:

Search

Added the principal and principalCollection data types to the externalConnection resource to specify the data type for people‑related property items in the external connection.

Security | Data security and compliance

  • Added the labelNotFoundException member to the usageRights enumeration type. This member represents a label with no protection settings, so there are no usage rights to evaluate in Microsoft Purview.
  • Deprecated the accessedResources property on processConversationMetadata in favor of the accessedResources_v2 property.
  • Use the accessedResources_v2 property on processConversationMetadata to get detailed information about resources accessed during the conversation, including identifiers, access type, and status.
  • Use the agents property on processConversationMetadata to get information about AI agents that participated in the preparation of the message.

Security | Email and collaboration protection

Enhancements to the detonationDetails resource that represents details from analysis of suspicious files and URLs in emails in Microsoft Defender for Office 365:

  • Added the following properties to provide more detailed threat analysis:
    • detonationBehaviourDetailsV2 - Shows events that took place during detonation in JSON format
    • entityMetadata - More metadata about the entity in JSON format
    • mitreTechniques - Attack techniques aligned with the MITRE ATT&CK framework
    • staticAnalysis - Results of static analysis performed on the file or URL
    • submissionSource - The source of the submission
  • The detonationBehaviourDetails property is deprecated and will stop returning data in March 2026. Use the detonationBehaviourDetailsV2 property instead.
  • Added the moveToQuarantine member to the remediationAction enumeration. Use the Prefer: include-unknown-enum-members request header to access this evolvable enum member.

Tasks and plans

Use the extended properties API to store or get custom data in the todoTaskList resource.

January 2026: New and generally available

Identity and access | Governance

Use the administrationScopeTargets relationship on the workflowBase, workflow, and workflowVersion resources to specify the administrative units in the scope of a lifecycle workflow.

Identity and access | Identity and sign-in

Reports | Microsoft 365 usage reports

Going forward, use the Microsoft 365 Copilot usage APIs under the /copilot URL path segment. For more information, see:

Security | Advanced hunting

Added migration guidance for Microsoft Defender for Endpoint (MDE) advanced hunting APIs to help organizations transition from the retired APIs that were available through the https://api.securitycenter.microsoft.com endpoint to the advanced hunting APIs available in Microsoft Graph. For more information, see Migrate from the older APIs.

Security | Alerts and incidents

  • Added the priorityScore property to the incident resource to provide a priority score for the incident from 0 to 100, with > 85 being the top priority, 15 - 85 medium priority, and < 15 low priority. This score is generated by machine learning and is based on multiple factors, including severity, disruption impact, threat intelligence, alert types, asset criticality, threat analytics, incident rarity, and other priority signals.
  • Made the following updates to APIs for managing Microsoft Defender for Identity (MDI) sensors:
    • Added the domainName property to the sensorCandidate resource to specify the domain name of the sensor.
    • Added the serviceStatus property to the sensor resource to indicate the service status. The possible values are: stopped, starting, running, disabled, onboarding, unknown, unknownFutureValue.

Security | eDiscovery

Use the reportFileMetadata property on ediscoveryPurgeDataOperation to get the purge job report file metadata.

Teamwork and communications | Apps

The TeamsAppInstallation.ManageSelectedForTeam.All is the least privileged application permission required to install or upgrade a Teams app that requires consent to resource-specific consent (RSC) permissions when using the teamsAppInstallation in a team: upgrade API.

Teamwork and communications | Messaging

Use the replyWithQuote method on the chatMessage resource to reply with a quote to a single chat message or multiple chat messages in a chat.

January 2026: New in preview only

Applications

The allowedTenantIds property on allowedTenantsAudience must contain at least one value and can't include more than 20 values.

Device and app management | Device updates

Added a new approval and deployment management model for Windows quality updates in Autopatch-managed environments. You can now define quality update policies with customizable approval rules, assign deployment rings to group devices for phased rollout, and manage the approval status of update content before deploying to devices. The following resources provide more information: