Methodology
How the tracker turns Microsoft's public sources into an operational change log. Public data only — no tenant data.
Sources
- Roadmap — Microsoft 365 Roadmap API
- Security — MSRC Security Update Guide CVEs, enriched with CISA KEV + FIRST EPSS
- Defender XDR / Entra — official "What's new" docs
- API changes — Microsoft Graph changelog
Cadence
Polled every 2 hours via GitHub Actions; the homepage shows last refresh and per-source health.
Change detection
Each run is diffed against the previous snapshot. Source changes are detected from a hash of the raw upstream record; normalized content is compared separately, so presentation-only re-normalizations don't emit events. Material text edits become sentence-level diffs; cosmetic edits are flagged.
Derived vs source data
Source-provided: titles, descriptions, dates, severity, products. Derived (heuristic): impact, urgency, normalized deadlines, cloud/on-prem applicability, normalized summaries, admin-action extraction, cosmetic classification.
Urgency
Distinct from technical severity and from evidence: exploited / passed-deadline → Immediate; near deadline, breaking, retiring → Soon; critical-without-exploitation and longer-term → Monitor.
Deadlines
Disparate date types are normalized into one deadline with a type (kev-due / retirement / deprecation / breaking / ga-target), date, precision (coarse roadmap targets like "Q1 CY2026" are kept verbatim, not faked to a day), source, and an action verb. Obligation deadlines ("act before") are separated from informational availability targets; /deadlines/ lists only obligations, soonest first.
Cloud vs on-premises
Each item is classified cloud, on-prem or hybrid from its product SKUs (e.g. Exchange Server vs Exchange Online) and roadmap cloud instances. Most M365 surfaces are cloud; security CVEs are where on-prem server products surface and need separate patching.
Classification confidence
Retirement / breaking-change / deprecation labels are confidence-scored from the source text, not bare keyword matches — the classifier looks at what is being removed. Removing a limitation (a size limit, a manual step, a requirement) is an enhancement, not a retirement. High-confidence labels drive the operational collections and "act before" deadline obligations; medium-confidence ones are marked "possible" and kept out of firm deadlines; low-confidence ones are dropped. Every detail page shows the matched rule and evidence under "How this was classified", and a small overrides.json corrects any residual misclassification.
Removal detection
An item that stops appearing upstream is marked "no longer in feed" with the last-observed date. A missing record is not automatically a cancellation — Microsoft hasn't necessarily confirmed it.
Retention
The change log keeps ~2,000 recent events; older events age out, so an item's history shows only changes still in that window.