(Updated) Retirement notice: MDE and XDR Advanced Hunting APIs retiring; migrate to Microsoft Graph Security API

🚨 The Signal: Microsoft is retiring the MDE and XDR Advanced Hunting APIs, requiring migration to the Microsoft Graph Security API by February 1, 2027. This unifies security data access, but requires manual updates to existing security automation and integrations.

The Impact

Security operations teams are affected, risking loss of automated threat detection and response capabilities if APIs are not migrated.

• Security operations: Risk of failed automated threat hunting and response.
• Security architects: Need to redesign and implement new API integrations.
• Compliance officers: Potential for gaps in security monitoring and reporting.

The Action

1. Identify all existing scripts and integrations using MDE or XDR Advanced Hunting APIs.
2. Review Microsoft Graph Security API documentation for Advanced Hunting schema and query changes.
3. Develop and test new API integrations using the Microsoft Graph Security API.
4. Update internal documentation for security operations procedures and API usage.
5. Deploy updated integrations to production environments by January 31, 2027.

Domain: Defender · Impact: high · Workload: Microsoft Defender