Major Update : Microsoft 365 – MDE and XDR APIs retiring; migrate to Microsoft Graph Security API – Action required by Jan 31, 2027
Hi All,
Greetings!
Today, I am sharing one of the MAJOR UPDATE related to Microsoft Defender for Endpoint (MDE) API and XDR API.
MAJOR UPDATE : Microsoft is retiring the Microsoft Defender for Endpoint (MDE) API and the XDR API. They are transitioning customers to the Microsoft Graph Security API.
Details:
- Microsoft is retiring the Microsoft Defender for Endpoint (MDE) API and the XDR API.
- Microsoft is transitioning customers to the Microsoft Graph Security API.
- The Microsoft Graph Security API provides broader data coverage, improved consistency, and better scalability for automation and security workflows.
- The MDE and XDR APIs will stop functioning after February 1, 2027.
- Existing scripts, automations, and workflows that rely on these APIs will fail if not updated.
- The Microsoft Graph Security API will be the supported API for accessing Microsoft security data.
Timelines
- Retirement start: February 6, 2026
- Full retirement: February 1, 2027
- After February 1, 2027, the MDE and XDR APIs will no longer function.
Actions need to be taken:
- Migrate all existing API workflows to the Microsoft Graph Security API by January 31, 2027.
- Update internal documentation, automation scripts, and integration endpoints to use the Microsoft Graph Security API.
- Communicate these changes to your security operations, engineering, and development teams.
REFERENCES
- Use the Microsoft Graph security API – https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-1.0
Thanks for reading 🙂
Keep reading, share your thoughts, experiences. Feel free to contact us to discuss more. If you have any suggestion / feedback / doubt, you are most welcome to discuss.
