Is Microsoft Graph Security going away and being replaced with Microsoft Graph Security API V2

Question

We currently are using Sophos for our mdr. We have a Microsoft Graph Security integration to our 365 tenent (i think that is correct). Microsoft states: Organizations currently using the legacy Alerts API must migrate to the v2 API to ensure continued data ingestion and functionality before its retirement. Which it says is April 2026, and this is also stated on Sophos website. I am really confused on this. Our current MS365 licenses are Business Basic and I cannot get the v2 to work within Sophos. Is this because of our MS365 license level? Microsoft Graph Security V1 is currently working.

Thanks,

Answer 1

Microsoft Graph Security is not going away, but the legacy Alerts API is being deprecated and will be removed by April 2026. Organizations currently using the legacy Alerts API are required to migrate to the new Microsoft Graph Security API V2 to ensure continued data ingestion and functionality. This migration is necessary as the legacy API will no longer be supported after the specified date.

Regarding your issue with the Microsoft Graph Security API V2 not working within Sophos, it is possible that your current Microsoft 365 Business Basic license may not support the features or functionalities required for the V2 API. It's advisable to check with Sophos support or Microsoft documentation to confirm the compatibility of your license with the new API.

Currently, the Microsoft Graph Security V1 is still operational, but transitioning to V2 is essential for future-proofing your integration as the legacy API will be phased out.

Answer 2

Hey Jeff, I am from Sophos, and a late reply I know, but I saw this and thought I would respond for the benefit of anyone else that stumbles on this like i did.

The answer above actually did call out why you can't get V2 working in Sophos, and it is because of the M365 license. With v1, Microsoft didn't restrict you connecting to it depending on your license, so it worked for all, but the value of it was questionable, because depending on your license and config, there may be no alerts to fetch.

With V2, Microsoft have restricted access to it to licenses that have an entitlement to Defender XDR. We document it on this page here: https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/ThreatAnalysisCenter/Integrations/Microsoft365/MSGraphSecurityV2/MSGraphV2Setup/index.html

and Microsoft have a list of licenses that have that entitlement here: https://learn.microsoft.com/en-us/defender-xdr/prerequisites

That doesn't mean you can't have Sophos MDR detecting threats in your Microsoft environment however. Even on the basic licenses, we can still detect threats via the Management Activity API, so make sure you get that one configured using the instructions here: https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/ThreatAnalysisCenter/Integrations/Microsoft365/365UserActivityLogs/index.html

We cover the differences and how the two work together on our main M365 integration docs page here: https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/ThreatAnalysisCenter/Integrations/Microsoft365/index.html

I hope that helps!