M365 Change Tracker

← Home

Methodology

How the tracker turns Microsoft's public sources into an operational change log. Public data only — no tenant data.

Sources

Cadence

Polled every 2 hours via GitHub Actions; the homepage shows last refresh and per-source health.

Change detection

Each run is diffed against the previous snapshot. Source changes are detected from a hash of the raw upstream record; normalized content is compared separately, so presentation-only re-normalizations don't emit events. Material text edits become sentence-level diffs; cosmetic edits are flagged.

Derived vs source data

Source-provided: titles, descriptions, dates, severity, products. Derived (heuristic): impact, urgency, normalized deadlines, cloud/on-prem applicability, normalized summaries, admin-action extraction, cosmetic classification.

Urgency

Distinct from technical severity and from evidence: exploited / passed-deadline → Immediate; near deadline, breaking, retiring → Soon; critical-without-exploitation and longer-term → Monitor.

Deadlines

Disparate date types are normalized into one deadline with a type (kev-due / retirement / deprecation / breaking / ga-target), date, precision (coarse roadmap targets like "Q1 CY2026" are kept verbatim, not faked to a day), source, and an action verb. Obligation deadlines ("act before") are separated from informational availability targets; /deadlines/ lists only obligations, soonest first.

Cloud vs on-premises

Each item is classified cloud, on-prem or hybrid from its product SKUs (e.g. Exchange Server vs Exchange Online) and roadmap cloud instances. Most M365 surfaces are cloud; security CVEs are where on-prem server products surface and need separate patching.

Classification confidence

Retirement / breaking-change / deprecation labels are confidence-scored from the source text, not bare keyword matches — the classifier looks at what is being removed. Removing a limitation (a size limit, a manual step, a requirement) is an enhancement, not a retirement. High-confidence labels drive the operational collections and "act before" deadline obligations; medium-confidence ones are marked "possible" and kept out of firm deadlines; low-confidence ones are dropped. Every detail page shows the matched rule and evidence under "How this was classified", and a small overrides.json corrects any residual misclassification.

Removal detection

An item that stops appearing upstream is marked "no longer in feed" with the last-observed date. A missing record is not automatically a cancellation — Microsoft hasn't necessarily confirmed it.

Retention

The change log keeps ~2,000 recent events; older events age out, so an item's history shows only changes still in that window.