Microsoft Warns IT Admins to Migrate Defender APIs Before February 2027

Microsoft has warned organizations that several Microsoft Defender security APIs will stop working on February 1, 2027, potentially disrupting existing security tools and automations.

According to Microsoft 365 Message Center advisory MC1220762, the company is retiring the Microsoft Defender for Endpoint and Defender XDR Advanced Hunting APIs. Organizations that still rely on these APIs must migrate before the deadline to avoid service disruptions.

Microsoft Defender Advanced Hunting APIs Will Be Retired

Microsoft is retiring the legacy APIs as part of its efforts to unify security integrations under the Microsoft Graph Security API.

The newer API offers greater consistency across Microsoft Defender products, improved scalability, and broader data coverage for security operations.

However, Microsoft warns that scripts, applications, and automated security workflows that depend on the older APIs may stop functioning after February 1, 2027.

The change could affect organizations that use custom integrations to collect security data, investigate threats, or automate incident response.

IT Administrators Must Migrate Before February 2027

Microsoft is urging IT administrators to complete their migration to the Microsoft Graph Security API by January 31, 2027.

Organizations should identify applications, scripts, and security workflows that use the affected APIs and update them to use Microsoft Graph.

Administrators should also test their integrations after migration to ensure that existing security operations continue working correctly. Microsoft recommends notifying security teams and other affected personnel about the upcoming retirement.

The company has published Microsoft Graph Security API documentation to help organizations prepare for the transition.

Importantly, Microsoft will not automatically migrate existing integrations. Organizations must handle the transition themselves, making it essential to complete the necessary changes before the February 1 deadline.

In other Microsoft news, the company recently removed custom CSS layout options from Entra ID to help prevent phishing attacks.

Meanwhile, Microsoft Azure qualified Seagate’s high-capacity storage setup for AI data centers, and Microsoft also released emergency .NET security updates to address a critical Brotli vulnerability.

Via Neowin