Breaking changes and API deprecations that may need admin or developer action.
See also: Exploited CVEs · Retirements · Graph API only
⏰ Act before December CY2026 · ~3 mo away
Microsoft Edge is updating its vertical tab implementation and architecture. Edge is reimplementing capabilities across pane, layout, controls, tab behavior, visual treatments, & embedder customizations. No admin action is required.
Windows Hello for Business (WHfB) and macOS Platform SSO (macOS PSSO) can now satisfy multifactor authentication as a standalone second factor. Previously, these methods only counted as MFA during primary sign-in, and users needed a separate passkey to complete step-up prompts, Authentication Strength policies, and sign-in frequency checks. With this change, WHfB and macOS PSSO work on their own for those scenarios, so more of your users can rely on strong, phishing-resistant sign-in without registering an extra method. What you need to know: Users who have only WHfB or macOS PSSO are now treated as MFA-capable and will no longer be automatically prompted to register another method. Because WHfB and macOS PSSO are tied to a specific device, we recommend having users register a portable method, such as a passkey or Microsoft Authenticator, during onboarding so they can complete MFA from any device.
⏰ Act before September CY2026 · ~1 mo away
People using Outlook for iOS on iPhone and iPad will see refreshed interface elements aligned with the latest Liquid Glass iOS visual experience, including modernized app chrome, navigation, and use of screen space. It will be enabled by default with no administrator action required.
OneDrive is updating its integration with the iOS Files app to use Apple's Replicated File Provider API. This update provides end-user improvements such as better upload progress. As part of the change, read-only Shared and Libraries locations will no longer appear in the Files app integration. Users can use Add to OneDrive for shared content and libraries they need to access, including write access where permitted.
⏰ Act before September CY2026 · ~1 mo away
We are providing a new configuration experience in Teams Admin Center where tenant admins can enable and customize an explicit consent message before joining any meeting hosted in their organization.
⏰ Act before September CY2026 · ~1 mo away
What’s new Teams now supports audio and video offloading for Town hall attendees in VDI environments that are using the new optimization. Media streams are offloaded directly to the user’s local device, improving performance and delivering a high definition viewing experience while reducing virtual desktop resource usage. Who it applies to • Windows endpoints only using the new VDI optimization • Supported VDI platforms: o Azure Virtual Desktop and Windows 365 o Citrix o Omnissa o Amazon WorkSpaces What stays the same All attendee interactivity features remain supported, including captions, DVR, reactions, streaming chat, and Q&A. Additional details First party and third party eCDNs are supported. When enabled, the attendee’s endpoint establishes a direct peer to peer connection using the local device network, avoiding virtual desktop double hop traffic. Action required No action is required if the new optimization for Microsoft Teams is already enabled.
The Microsoft365CopilotChatIconEnabled policy is becoming the standard for configuring Copilot Chat. Extension and sidebar policies will no longer affect the appearance or functionality of Copilot Chat.
We are updating private channels to align with compliance model for all channels. After this change, compliance policies applied to the team (M365 Group) will apply to all channels in the team - across standard, private, and shared. Private channels will no longer need user level targeting of policies different from other channels, and private channel compliance messages will no longer be copied to user mailboxes, relying on a dedicated, internal mailbox per channel like shared channels. In addition, limits for private channels will be increased so each team can have more than 30 private channels, up to the 1000 total channel limit per team. Private channel member limits will increase from 250 to 5000. You will also be able to schedule meetings in private channels.
⏰ Act before November CY2025 · overdue
We're simplifying how organizations grant applications permission to send email on behalf of mailboxes. Today, customers must manually assign permissions to each individual mailbox using PowerShell, which is time-consuming and inefficient. With this new capability, admins can assign the SMTP.SendAsApp role to an app through App Role-Based Access Control (RBAC), enabling group-based or scoped access to mailboxes. This eliminates the need for per-mailbox configuration and streamlines onboarding for SMTP clients using OAuth. It’s a scalable, secure, and modern approach to managing mailbox access for applications.
⏰ Act before August CY2025 · overdue
To improve clarity and transparency, we’re updating the audit data for events related to Microsoft Purview role group membership changes. This update affects audit events under the SecurityComplianceRBAC workload (RecordType 87), specifically for operations for GrantPermission, DeletePermission. While the audit schema remains unchanged, the PreExecutionMessage and PostExecutionMessage fields will be refined to better reflect the nature of the changes captured in the logs. Action Required: If your organization consumes these audit log events programmatically (e.g., via scripts or automation tools), please review and update your parsing logic to accommodate the enhanced message content. Rollout Timeline: This change will be rolled out starting in August. We recommend validating your systems against the updated message format as soon as it becomes available in your environment.
⏰ Act before December CY2025 · overdue
OCR Cost Estimator allows you to estimate the potential cost for using Optical Character Recognition. This means that you will no longer be required to set up an Azure Subscription for billing first and can accurately estimate the cost you would have incurred while using OCR. This will help you to identify the optimal configuration settings for OCR as per your requirements. Cost Estimator can be used for 30 days and will not scan images for sensitive content.
⏰ Migrate before Aug 1, 2026 · passed 23d ago
What is changing? Starting August 2026, users will see an improved restore experience for device-bound Authenticator app passkeys for iOS users. No admin or user action is required.
Added the migrate method to the crossTenantMigrationJob resource. Changed the behavior of the validate method on the crossTenantMigrationJob resource to validate an existing job as an entity-bound action. Going forward, use the POST /solutions/migrations/crossTenantMigrationJobs/{crossTenantMigrationJobId}/validate endpoint to trigger the validation of an existing cross-tenant migration job. Removed the displayName parameter from the validate method. Removed the completeAfterDateTime parameter from the validate method. Removed the sourceTenantId parameter from the validate method. Removed the exchangeSettings parameter from the validate method. Removed the workloads parameter from the validate method. Removed the resourceType parameter from the validate method. Removed the resources parameter from the validate method.
Added the policyTip member to the dlpAction enumeration. Removed the overrideOption property from the notifyUserAction resource. Removed the policyTip property from the notifyUserAction resource. Added the policyTipAction resource.
Added the detectionRuleStatus enumeration type. Added the accountObjectIdAction resource. Added the accountSidAction resource. Added the alertCustomDetails resource. Removed the alertTemplate resource. Deprecated the allowFileResponseAction resource. Added the automatedAction resource. Added the automatedActionSet resource. Deprecated the blockFileResponseAction resource. Deprecated the collectInvestigationPackageResponseAction resource. Removed the detectionAction resource. Added the deviceAction resource. Deprecated the disableUserResponseAction resource. Added the emailAction resource. Added the fileAction resource. Deprecated the forceUserPasswordResetResponseAction resource. Deprecated the hardDeleteResponseAction resource. Deprecated the impactedAsset resource. Deprecated the impactedDeviceAsset resource. Deprecated the impactedMailboxAsset resource. Deprecated the impactedUserAsset resource. Deprecated the initiateInvestigationResponseAction resource. Added the isolateDeviceAction resource. Deprecated the isolateDeviceResponseAction resource. Deprecated the markUserAsCompromisedResponseAction resource. Added the mitreTactic resource. Added the mitreTechnique resource. Deprecated the moveToDeletedItemsResponseAction resource. Deprecated the moveToInboxResponseAction resource. Deprecated the moveToJunkResponseAction resource. Added the deviceGroups property to the organizationalScope resource. Deprecated the organizationalScope resource. Deprecated the organizationalScope resource. Deprecated the queryCondition resource. Deprecated the responseAction resource. Deprecated the restrictAppExecutionResponseAction resource. Added the frequency property to the ruleSchedule resource. Deprecated the ruleSchedule resource. Deprecated the ruleSchedule resource. Deprecated the runAntivirusScanResponseAction resource. Deprecated the runDetails resource. Deprecated the softDeleteResponseAction resource. Added the stopAndQuarantineFileAction resource. Deprecated the stopAndQuarantineFileResponseAction resource. Added the accountEntityMapping resource. Added the alertTemplate resource. Added the amazonResourceEntityMapping resource. Added the azureResourceEntityMapping resource. Added the cloudApplicationEntityMapping resource. Added the detectionAction resource. Added the createdBy property to the detectionRule resource. Added the createdDateTime property to the detectionRule resource. Added the description property to the detectionRule resource. Removed the detectionAction property from the detectionRule resource. Deprecated the detectionRule resource. Added the displayName property to the detectionRule resource. Added the id property to the detectionRule resource. Added the isEnabled property to the detectionRule resource. Added the lastModifiedBy property to the detectionRule resource. Added the lastModifiedDateTime property to the detectionRule resource. Deprecated the detectionRule resource. Added the status property to the detectionRule resource. Added the detectionAction relationship to the detectionRule resource. Added the dnsEntityMapping resource. Added the entityMapping resource. Added the entityMappingConfiguration resource. Added the fileEntityMapping resource. Added the googleCloudResourceEntityMapping resource. Added the hostEntityMapping resource. Added the ipEntityMapping resource. Added the mailboxEntityMapping resource. Added the mailClusterEntityMapping resource. Added the mailMessageEntityMapping resource. Added the oAuthApplicationEntityMapping resource. Added the processEntityMapping resource. Removed the protectionRule resource. Added the registryValueEntityMapping resource. Added the securityGroupEntityMapping resource. Added the urlEntityMapping resource.
Added the applicationDataType enumeration type. Added the csaStarLevel enumeration type. Added the dataProtection enumeration type. Added the dataRetentionLevel enumeration type. Added the fedRampLevel enumeration type. Added the holdType enumeration type. Added the passwordPolicy enumeration type. Added the pciVersion enumeration type. Added the restEncryptionType enumeration type. Added the sslVersion enumeration type. Added the userOwnership enumeration type. Added the applicationLocation resource. Added the applicationRiskFactorCertificateInfo resource. Added the applicationRiskFactorGeneralInfo resource. Added the applicationRiskFactorLegalInfo resource. Added the applicationRiskFactorLegalInfoGdpr resource. Added the applicationRiskFactors resource. Added the applicationRiskFactorSecurityInfo resource. Added the applicationRiskScore resource. Added the applicationSecurityCompliance resource. Added the deprecationDate property to the applicationTemplate resource. Added the endpoints property to the applicationTemplate resource. Added the isEntraIntegrated property to the applicationTemplate resource. Added the lastModifiedDateTime property to the applicationTemplate resource. Added the riskFactors property to the applicationTemplate resource. Added the riskScore property to the applicationTemplate resource. Added the licenseRequired resource.
Removed the troubleshootDetailsReport member from the cloudPCTroubleshootReportType enumeration. Removed the troubleshootTrendCountReport member from the cloudPCTroubleshootReportType enumeration. Removed the troubleshootRegionalReport member from the cloudPCTroubleshootReportType enumeration. Removed the troubleshootIssueCountReport member from the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantGlobalFilterReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantNetworkTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantNetworkAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantConnectionFailureRateTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantConnectionFailureRateAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantCloudPCHealthTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantCloudPCHealthAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantActiveConnectionCountTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantActiveConnectionCountAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantMeanTimeToFailureTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantMeanTimeToFailureAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantRemoteSignInTimeTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantRemoteSignInTimeAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootEventsOfViewDataTableReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantEnvironmentMetricsOfViewDataTableReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCMetricsOfViewDataTableReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootConfigurationConnectionCountTrendV1Report member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootConfigurationTotalConnectionCountBarV1Report member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootConfigurationGlobalFilterV1Report member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootConnectionConfigurationOfViewDataTableV1Report member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootTenantConnectedDevicesOfViewDataTableReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootEnvironmentOverviewOfViewDataTableReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCNetworkTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCNetworkAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCErrorTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCErrorAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCDurationTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCDurationAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCRemoteSignInTimeTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCRemoteSignInTimeAggregatedReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCListReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootCloudPCHealthTrendReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootMatchedUserReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootMatchedCloudPCReport member to the cloudPCTroubleshootReportType enumeration. Added the troubleshootUserListReport member to the cloudPCTroubleshootReportType enumeration.
Removed the GET operation from the photoUpdateSettings resource. Removed the POST operation from the photoUpdateSettings resource. Removed the DELETE operation from the photoUpdateSettings resource.
Added the categories property to the alert resource. Deprecated the category property on the alert resource. Use the categories property instead.
⏰ Update before removal May 1, 2026 · passed 115d ago
Added a deprecation notice to the agentRegistry resource and related APIs indicating that these Agent Registry APIs will be replaced by Agent 365-based APIs starting May 1, 2026. Added a deprecation notice to the agentCardManifest resource indicating that these Agent Registry APIs will be replaced by Agent 365-based APIs starting May 1, 2026. Added a deprecation notice to the agentCollection resource indicating that these Agent Registry APIs will be replaced by Agent 365-based APIs starting May 1, 2026. Added a deprecation notice to the agentInstance resource indicating that these Agent Registry APIs will be replaced by Agent 365-based APIs starting May 1, 2026.
Added the deprecationDate property to the applicationTemplate resource.
Deleted the model query parameter from the update operation of the chatMessage resource. Deleted the model query parameter from the chats: getAllMessages method. Deleted the model query parameter from the chat: getAllRetainedMessages method. Deleted the model query parameter from the channel: getAllMessages method. Deleted the model query parameter from the channel: getAllRetainedMessages method. Deleted the model query parameter from the deletedTeam: getAllMessages method. Deleted the model query parameter from the create operation of the subscription resource.
Added the keyCredentials property to the appManagementConfiguration resource. Added the passwordCredentials property to the appManagementConfiguration resource. Removed the keyCredentials relationship from the appManagementConfiguration resource. Removed the passwordCredentials relationship from the appManagementConfiguration resource. Added the customSecurityAttributes property to the appManagementPolicyActorExemptions resource. Removed the customSecurityAttributes relationship from the appManagementPolicyActorExemptions resource. Changed the customSecurityAttributeExemption resource from an entity type to a complex type. Changed the customSecurityAttributeStringValueExemption resource from an entity type to a complex type. Changed the keyCredentialConfiguration resource from an entity type to a complex type. Changed the passwordCredentialConfiguration resource from an entity type to a complex type.
Added the samsungEFotaFirmwareVersion resource. Added the samsungEFotaFirmwareVersionTarget resource. Added the samsungEFotaFirmwareVersions property to the deviceManagement resource. Removed the samsungEFotaFirmwareVersions relationship from the deviceManagement resource. Removed the samsungEFotaFirmwareVersion resource. Removed the samsungEFotaFirmwareVersionTarget resource. Added the androidAppCredentialProviderRoleState enumeration type. Added the credentialProviderRoleState property to the androidForWorkMobileAppConfiguration resource. Added the credentialProviderRoleState property to the androidManagedStoreAppConfiguration resource. Added the wpa3Personal member to the wiFiSecurityType enumeration. Added the isKioskModeExitCodeSet property to the androidDeviceOwnerGeneralDeviceConfiguration resource. Added the controlledConfigurationEnabled property to the windowsProtectionState resource. Added the windowsZtdnsExemptionRule resource. Added the deviceConfiguration resource. Added the windowsZtdnsConfiguration resource. Added the releaseAppleDevices method to the depOnboardingSetting resource. Added the deviceAndAppManagementAssignmentFilterType enumeration type. Added the deviceAndAppManagementAssignmentSource enumeration type. Added the deviceAndAppManagementPayloadType enumeration type. Added the devicePlatformType enumeration type. Added the allDevicesAssignmentTarget resource. Added the allLicensedUsersAssignmentTarget resource. Added the configurationManagerCollectionAssignmentTarget resource. Added the deviceAndAppManagementAssignmentTarget resource. Added the exclusionGroupAssignmentTarget resource. Added the groupAssignmentTarget resource. Added the deviceManagement resource.
Removed the domain property from the externalTokenBasedSapIagConnectionInfo resource.
Added the retryUpload method to the cloudPcDeviceImage resource. Deprecated the reupload method on the cloudPcDeviceImage resource. Going forward, use the retryUpload API instead.
Removed the allowedAudiences property from the profilePropertySetting resource. Added the displayName property to the profilePropertySetting resource. Removed the isUserOverrideForAudienceEnabled property from the profilePropertySetting resource.
Added the fotaConnectorState enumeration type. Added the fotaDeploymentErrorCode enumeration type. Added the fotaDeploymentState enumeration type. Added the fotaDownloadPeriodType enumeration type. Added the fotaFirmwareUpdateType enumeration type. Added the fotaNetworkType enumeration type. Added the fotaOemType enumeration type. Added the fotaRegistrationErrorCode enumeration type. Added the fotaRegistrationState enumeration type. Added the samsungEFotaScheduleMode enumeration type. Added the fotaDeploymentSetting resource. Added the fotaDeploymentStatus resource. Added the fotaDeviceRegistrationStatus resource. Added the samsungEFotaDeploymentSetting resource. Added the fotaConnector relationship to the deviceManagement resource. Added the fotaConnectors relationship to the deviceManagement resource. Added the fotaDeployments relationship to the deviceManagement resource. Added the samsungEFotaDeployments relationship to the deviceManagement resource. Added the samsungEFotaFirmwareVersions relationship to the deviceManagement resource. Added the fotaConnector resource. Added the fotaDeployment resource. Added the samsungEFotaDeployment resource. Added the samsungEFotaFirmwareVersion resource. Added the samsungEFotaFirmwareVersionTarget resource. Added the cancel method to the fotaDeployment resource. Added the connect method to the fotaConnector resource. Added the deregister method to the fotaConnector resource. Added the disconnect method to the fotaConnector resource. Added the oem parameter to the getZebraFotaDeploymentReport method. Added the register method to the fotaConnector resource. Added the retrieveFotaDeploymentReport method to the deviceManagementReports resource. Added the retrieveFotaDeviceRegistrationReport method to the deviceManagementReports resource. Added the hasActiveDeployments method to the fotaConnector resource. Added the retrieveConsumerSoftwareCustomizationCode method to the fotaConnector resource. Added the retrieveDeployment method to the fotaDeployment resource. Added the retrieveDeployments method to the fotaDeployment resource. Added the retrieveFotaAuthorizationUrl method to the fotaConnector resource. Added the retrieveFotaConnector method to the fotaConnector resource. Added the retrieveFotaDeviceModels method to the fotaConnector resource. Added the retrieveSalesCodes method to the fotaConnector resource. Added the productDescription property to the mobileAppCatalogPackage resource. Added the branchId property to the win32MobileAppCatalogPackage resource. Added the windowsAutoUpdateCatalogApp resource. Removed the iosDdmLobAppAssignmentSettings resource. Added the windowsRecoveryAndRemediationConfiguration member to the deviceManagementConfigurationTemplateFamily enumeration. Removed the sendDeviceOwnershipChangePushNotification property from the intuneBrand resource. Added the suspendManagedHomeScreen member to the remoteAction enumeration. Added the restoreManagedHomeScreen member to the remoteAction enumeration. Added the deviceLocalAdminAccountDetail resource. Added the macOSDeviceLocalAdminAccountDetail resource. Added the restoreManagedHomeScreen method to the managedDevice resource. Added the rotateRecoveryLockPasscode method to the managedDevice resource. Added the suspendManagedHomeScreen method to the managedDevice resource. Added the retrieveDeviceLocalAdminAccountDetail method to the managedDevice resource. Added the retrieveRecoveryLockPasscode method to the managedDevice resource. Added the usePlatformSSODuringSetupAssistant property to the depMacOSEnrollmentProfile resource. Removed the deviceWipe member from the operationApprovalPolicyType enumeration. Added the deviceRetire member to the operationApprovalPolicyType enumeration. Added the deviceDelete member to the operationApprovalPolicyType enumeration. Added the tenantConfiguration member to the operationApprovalPolicyType enumeration. Added the id property to the deviceManagementReports resource. Removed the sendDeviceOwnershipChangePushNotification property from the intuneBrandingProfile resource.
Added the resourceAccessStatus enumeration type. Added the resourceAccessType enumeration type. Added the aiAgentInfo resource. Added the aiInteractionEntity resource. Removed the identifier property from the aiInteractionPlugin resource. Removed the name property from the aiInteractionPlugin resource. Removed the version property from the aiInteractionPlugin resource. Deprecated the processConversationMetadata resource. Deprecated the accessedResources property in the processConversationMetadata resource. Use the accessedResources_v2 property instead. Added the accessedResources_v2 property to the processConversationMetadata resource. Added the agents property to the processConversationMetadata resource. Added the resourceAccessDetail resource.
Removed the group member from the siteTemplateType enumeration.
Deprecated the detonationBehaviourDetails resource. Use the detonationBehaviourDetailsV2 property of the detonationDetails resource instead. Added the detonationBehaviourDetailsV2 property to the detonationDetails resource. Added the entityMetadata property to the detonationDetails resource. Added the mitreTechniques property to the detonationDetails resource. Added the staticAnalysis property to the detonationDetails resource. Added the submissionSource property to the detonationDetails resource. Added the moveToQuarantine member to the remediationAction enumeration.
⏰ Update before removal Aug 20, 2025 · passed 369d ago
Added the resourceAccessStatus enumeration type. Added the resourceAccessType enumeration type. Added the aiAgentInfo resource type. Added the aiInteractionEntity resource type. Removed the identifier property from the aiInteractionPlugin resource in favor of the identifier property inherited from its base type. Removed the name property from the aiInteractionPlugin resource in favor of the name property inherited from its base type. Removed the version property from the aiInteractionPlugin resource in favor of the version property inherited from its base type. Deprecated the accessedResources property of the processConversationMetadata resource. The accessedResources property is deprecated and stopped returning data on August 20, 2025. Going forward, use the accessedResources_v2 property. Added the accessedResources_v2 property to the processConversationMetadata resource. Added the agents property to the processConversationMetadata resource. Added the resourceAccessDetail resource type.
Deprecated the List shared method of the sharedInsight resource. This API is deprecated and will stop returning data after November, 2026. Deprecated the List used method of the usedInsight resource. This API is deprecated and will stop returning data after November, 2026.