Edit

What's new in Microsoft Graph

Microsoft Graph provides a unified programmability model that you can use to access data in Microsoft 365, Windows, and Enterprise Mobility + Security. This article provides information about what's new in Microsoft Graph APIs, documentation, SDKs, and more.

For more detailed API-level updates, see the Microsoft Graph API changelog.

For details about previous updates to Microsoft Graph, see Microsoft Graph what's new history.

Important

Features in preview status are subject to change without notice, and might not be promoted to generally available (GA) status. Don't use preview features in production apps.

November 2026: New and generally available

Backup and recovery | Microsoft 365 backup and storage

  • Added audit metadata to the browseQueryResponseItem resource. Use this metadata to identify when a file or folder was created or last modified and who made the change when you select items for granular restore.

Mail

Added the distributionList resource type and related methods for managing personal distribution lists in a user's mailbox. Use these APIs to create, read, update, and delete distribution lists, and add or remove members.

November 2026: New in preview only

Identity and access | Directory management

  • Devices now support soft-deletion and restoration. When a device is deleted, it's moved to the deleted items container and can be restored within 30 days. After 30 days, it's permanently deleted.

Teamwork and communications | Messaging

October 2026: New and generally available

Applications

  • Added the kerberosTicket property to the optionalClaims resource type to select group SID categories for Kerberos tickets. Use the configuring application's groupMembershipClaims setting to scope eligible memberships within those categories.

Backup and recovery | Microsoft 365 backup and storage

  • Use the policyId property on the restoreSessionBase resource to scope restore sessions to a protection policy.
  • Use the optional policyId parameter on the restorePoint: search method to validate protection-unit membership and improve policy-scoped routing. You can also filter the restore points collection by protectionUnit/policyId.
  • Added the getStatisticsByPolicy method to the backupReport resource type in v1.0. Use it to retrieve policy-level protection statistics for Microsoft 365 Backup Storage.

Calendars

  • Promoted the isSharedWithMe property of calendar resource from beta to v1.0. The property is used to identify the shared calendars.
  • Added the delta method to the calendar resource type. Use it to track calendars added, deleted, or updated in a user's mailbox.

Calendars | Places

  • Use the lastUpdatedTime and customProperties properties on the place resource to read when a place was last updated and manage custom string key-value metadata.
  • The Place update API doesn't honor administrative roles assigned to groups in Microsoft Entra ID. Instead, assign the required role directly to the user in Microsoft Entra ID, or assign it to a user or group through the Microsoft 365 admin center.

Identity and access | Directory management

Promoted the managerApplications property on the agentUser resource type from beta to v1.0. Use it to read the application IDs authorized to manage the agent user's backing agent blueprint. The property is read-only and is returned only when explicitly selected with the microsoft.graph.agentUser type cast.

Identity and access | Governance

  • Added the isEnabled property to the roleManagementCustomCalloutExtension resource type in v1.0. Use it to enable or disable a PIM custom extension without deleting it.
  • Added the applicationAuthorization and appRoles members to the customExtensionResourceType enumeration in v1.0, extending the supported values of resourceType on roleManagementCustomCalloutExtension. Use the Prefer: include-unknown-enum-members request header to retrieve these values.
  • Added the groupResource resource type and the resources relationship to the privilegedAccessGroup resource. Use them to list and get groups managed through Privileged Identity Management (PIM) for groups.

Identity and access | Identity and sign-in

  • Added the federatedTokenValidationPolicy resource to control which federated domains Microsoft Entra ID accepts tokens from on a per-tenant basis, as a defense-in-depth measure against token-replay and rogue-IdP scenarios.
  • Added support for routing SMS and voice authentication traffic through a telecom provider integration. Configure the provider endpoint, application identifier, evaluation mode, and migration percentage through the telecomProviderSettings property on the smsAuthenticationMethodConfiguration and voiceAuthenticationMethodConfiguration resources.

Mail | Message trace

Added support to identify recalled messages in message trace. Use recalled as a supported value of the status property of the exchangeMessageTrace resource.

Reports | Partner billing reports

Added the billedAggregatedUsage resource and related export method to the v1.0 endpoint. Cloud Solution Provider partners can use the export method to generate billed aggregated Azure usage reports for a specific invoice.

Security | Audit log query

Added 35 members, from PlannerCustomFieldDefinition through MESRawEmailContentMetadata, to the auditLogRecordType enumeration and added the matching auditData derived types to represent workload-specific audit event payloads.

Security | Custom detection rules

Added support for managing Microsoft Defender XDR custom detection rules in v1.0 through the detectionRule resource.

Tasks and plans

Added support for single-value extended properties on todoTask and todoTaskList resources, enabling apps to store and retrieve custom data for Microsoft To Do tasks and task lists.

Teamwork and communications | Calls and online meetings

Added the engagements property to the attendanceRecord resource. Use it to get real-time participant interaction behaviors that are captured as part of the attendance report, including reactions, hand raises, camera toggles, and microphone mute and unmute events.

Tenants | Cross-tenant migration

Added the cross-tenant migration API and related methods to the v1.0 endpoint. Use the API to create migration jobs, validate their configuration, migrate user data between Microsoft 365 tenants, monitor migration status, and cancel migration jobs or individual user tasks.

Tenants | Tenant governance

Added the refreshStatus method to get the status of the most recent related tenants refresh operation.

October 2026: New in preview only

Applications

Added the audit member to the appManagementRestrictionState enumeration type used by the appManagementPolicy resource. Use this value to evaluate application management policy restrictions without enforcing them.

Backup and recovery | Microsoft 365 backup and storage

  • Track admin activities on backup and restore resources, including policy changes, dynamic rule executions, offboarding, and restore task completions, by using the activityLogBase resource and its derived types.
  • Removed the tags property on the restoreTaskActivityLog in favor of the restoreJobType property. Use the restoreJobType property with values from the restoreJobType enumeration type.
  • Added the backupPolicyDeleted member as a new supported value for the activityType property on the activityLogBase resource and its derived types.

Calendars | Places

The Place update API doesn't honor administrative roles assigned to groups in Microsoft Entra ID. Instead, assign the required role directly to the user in Microsoft Entra ID, or assign it to a user or group through the Microsoft 365 admin center.

Device and app management | Cloud PC

  • Updated the date when deprecated image properties on cloudPcDeviceImage, cloudPcSourceDeviceImage, and cloudPcGalleryImage will stop returning data from January 31, 2024 to December 7, 2026. No replacement is planned for recommendedSku. Review the replacement property guidance in these resource topics and update affected integrations before the deadline.
  • Added support for extending Windows 365 Reserve access for multiple users through the submitManagedLicenseOperation action on the cloudPcManagedLicense collection. Poll the submitted operation to check completion and inspect per-user results.
  • Use the retrieveManagedLicenseOperation operation to retrieve the status and per-user results of a submitted operation.

Device and app management | Device updates

Files

Updated the getSharePointApiUsage method to support SharePoint service prioritization reports. Use this report to retrieve total, standard, heavy, billed standard, and billed heavy API request counts by application and date.

Identity and access | Directory management

  • Added the objectConnection resource type and related methods to inspect or clear cached connector data store linkage records.
  • Added the objectConnections relationship to the synchronizationJob resource to access linkage records for known object identifiers.

Identity and access | Governance

  • Added the accessDriftSummary resource type and related methods for identifying governed resources whose actual access differs from access-package intent. Use it to list and inspect drift summaries, retrieve drift details, and download bulk reconciliation reports. Access drift details identify whether each affected identity is a user or group through the identityType property of entraDriftIdentityInfo.
  • Added methods to read and configure a user's approverDelegate. Use them to delegate approval of Microsoft Entra entitlement management access package assignment requests and access reviews to another user or group for a specified period of time. Users can manage their own delegate, and Identity Governance Administrators can manage the delegate of any user.
  • Added the gracePeriodInDays property to the lifecyclePolicyRule resource. Use it to configure an optional grace period for each lifecycle policy rule before the policy action sequence starts.
  • Added the roleManagementCustomCalloutExtension resource type and related methods for integrating external approval, ticketing, compliance, and audit workflows into Privileged Identity Management role assignment lifecycle events. Use these capabilities to associate custom extensions with role management policies, submit approval or denial results for Microsoft Entra role and group assignment requests, and optionally update assignment schedules.

Identity and access | Identity and sign-in

  • Added public preview support for OnPasswordUpdate custom authentication extensions. Use the onPasswordUpdateCustomExtension resource to notify external systems after a self-service password reset and the onPasswordUpdateListener resource to configure when the notification occurs.
  • Added support for routing SMS and voice authentication traffic through a telecom provider integration. Configure the provider endpoint, application identifier, evaluation mode, and migration percentage through the telecomProviderSettings property on the smsAuthenticationMethodConfiguration and voiceAuthenticationMethodConfiguration resources.
  • Added the identityVerificationEventsConfiguration property to the verifiableCredentialsAuthenticationMethodConfiguration resource. Use it to control tenant-wide collection and exposure of identity verification events and credential provenance information for Verified ID verification.
  • Added the conditionalAccessPolicyPlan resource type and related methods for grouping shared Conditional Access conditions with scenario-specific rules. Use policy plans to consolidate common targeting conditions and manage rule-specific enforcement controls.

Groups

Added the mailboxId property to the group resource type to identify the Exchange mailbox associated with a Microsoft 365 group. The property is returned only when specified in $select.

Identity and access | Directory management

Added the isHardDeleteProtectionEnabled property to the user (excluding on-premises synchronized users), group, application, and servicePrincipal resources. Enable hard deletion protection on existing objects to block permanent deletion for seven days after soft deletion. Once enabled, protection can't be disabled.

Mail

Added the importMime method to the mailFolder resource to create a non-draft message in a mail folder directly from MIME content. Unlike creating a message, which always creates a draft, this method creates the message in a final, non-draft state. The message appears in the destination folder as if it was delivered; however, it doesn't go through transport, isn't stamped as sent, and never appears in the Sent Items folder. The action preserves the full MIME content, including internet message headers, body parts, and attachments. Use the importMime API to import existing mail into a mailbox, such as to migrate messages from another system.

Mail | Message trace

Added support to identify recalled messages in message trace. Use recalled as a supported value of the status property of the exchangeMessageTrace resource.

Mailbox import and export

  • Added the isHidden property to the mailboxFolder resource to identify hidden mailbox folders.
  • Use the existing includeHiddenFolders query parameter for listing folders and listing child folders. Set it to true to include both hidden and nonhidden folders.

Reports | Identity and access reports

  • Added the appManagementAudit resource type and related methods to retrieve Microsoft Entra application management audit logs. Use these APIs to understand how app management policy restrictions affected application and service principal changes.
  • Added the passwordUpdate member to the eventType property of the appliedAuthenticationEventListener resource to identify OnPasswordUpdate custom extension listeners triggered during sign-ins.
  • Added the notAppliedAllAppsExclusion and reportOnlyNotAppliedAllAppsExclusion members to the appliedConditionalAccessPolicyResult enumeration used by the result property of appliedConditionalAccessPolicy. Use these values to distinguish enabled and report-only policies skipped by an enabled all-apps exclusion from policies that don't apply for other reasons.

Security

Added the incidentConfiguration property to the detectionAction resource and the incidentConfiguration complex type. Use this setting to exclude alerts generated by a custom detection rule from automatic incident correlation and create standalone, single-alert incidents.

Security | Audit log query

Added 35 members, from PlannerCustomFieldDefinition through MESRawEmailContentMetadata, to the auditLogRecordType enumeration and added the matching auditData derived types to represent workload-specific audit event payloads.

Security | Case management

Clarified the existing maximum length of the message property on the comment resource: 1,000 characters for incident cases and 5,000 characters for generic cases. These limits apply when you create a comment activity. The 5,000-character limit also applies when you update a comment activity in a generic case; the update of comment activities in incident cases remains unsupported.

Security | Data security and compliance

  • Applications can now supply one or more sensitivity labels with file content submitted to the processContent API by using the sensitivityLabels property of processContentMetadataBase.
  • Added the unknownFutureValue member to the applicationMode enumeration as a sentinel for future application modes.
  • Updated the evaluationErrorType enumeration to use customer-facing reasons for incomplete policy evaluations, and removed the errorMessage property from the evaluationErrorDetail complex type. Use errorType to identify why an evaluation couldn't be completed.

Security | Workbooks

Added the workbook resource type and related methods to manage tenant-scoped Microsoft Security workbook documents. Use stable IDs for repeatable deployments and replace a workbook's JSON content as a complete document.

Teamwork and communications | Messaging

Contribute to Microsoft Graph

Are there scenarios you'd like Microsoft Graph to support?

  • Suggest and vote for new features by using the Microsoft Graph Feedback Portal. Some new features originate as popular requests from the developer community. The Microsoft Graph team regularly evaluates customer needs and releases new features to the beta (https://graph.microsoft.com/beta) and v1.0 (https://graph.microsoft.com/v1.0) endpoints.

  • Join the weekly Microsoft 365 platform community call and become an active member of the Microsoft Graph community. To discover the full calendar of developer calls, visit the Microsoft 365 and Power Platform community page.

  • Join our research panel to provide your input on our developer experiences.

Related content

  • Last updated on