What's new in Microsoft Graph

Microsoft Graph provides a unified programmability model that you can use to access data in Microsoft 365, Windows, and Enterprise Mobility + Security. This article provides information about what's new in Microsoft Graph APIs, documentation, SDKs, and more.

For more detailed API-level updates, see the Microsoft Graph API changelog.

For details about previous updates to Microsoft Graph, see Microsoft Graph what's new history.

Important

Features in preview status are subject to change without notice, and might not be promoted to generally available (GA) status. Don't use preview features in production apps.

September 2026: New and generally available

Groups

Added the onPremisesExtensionAttributes property to the group resource. Use it to access extension attributes 1-15 synchronized from on-premises Active Directory.

Identity and access | Governance

• Promoted the access reviews customer-provided data APIs from beta to v1.0. Use them to review entitlement data that you upload for resources that Microsoft Entra doesn't discover itself, such as third-party applications. The promoted surface includes:
  • the description property on accessReviewInstanceDecisionItemResource to describe the resource under review.
  • accessReviewInstanceDecisionItemPermission complex type and the permission property on accessReviewInstanceDecisionItem, which describe the permission that grants the principal access to the resource under review.
  • accessReviewInstanceDecisionItemCustomDataProvidedResource complex type, which represents a decision item resource whose entitlement data is supplied by the customer rather than discovered by Microsoft Entra.
  • batchApplyCustomDataProvidedResourceDecisions method on accessReviewInstance to set the apply result on all decision items that match a customer-provided resource in one call.
  • accessReviewInstanceDecisionItemApplyResult enumeration type to represent the result of applying a recorded decision to the target resource.
• Clarified that the List resources method returns SharePoint Online resources only when it's called with delegated permissions. To retrieve SharePoint site information with application permissions, use the sites: getAllSites method.

Teamwork and communications | Messaging

Updated the getAllRetainedMessages method to support exporting retained versions of private-channel messages that were edited or deleted after the tenant completed private-channel storage migration.

September 2026: New in preview only

Agents

Added the isDisabled property to the agentIdentityBlueprint resource. Use it to deactivate an agent identity blueprint without deleting it.

Backup and recovery | Microsoft 365 backup and storage

• Added the policyId property to the restoreSessionBase resource type to scope restore sessions to a protection policy.
• Added the optional policyId parameter to the restorePoint: search method to validate protection-unit membership and improve policy-scoped routing. You can also filter the restore points collection by protectionUnit/policyId.

Backup storage

• Added the getStatisticsByPolicy method to retrieve policy-level protection statistics for Microsoft 365 Backup Storage. Use the report to monitor protected and unprotected artifacts across completed, in-progress, and failed states, review offboarding activity, and determine when the metrics were last calculated.

Calendar | Places

• Added the stringDictionary resource type to represent custom string key-value pairs.
• Added the customProperties property to the place resource type to store customer-defined string key-value pairs.
• Added the read-only lastUpdatedTime property to the place resource type to indicate when the place was last updated.

Device and app management | Cloud PC

• Added the isDisasterRecoveryActive property to the cloudPC resource to indicate whether the Cloud PC currently runs in its disaster recovery region after a failover event.
• Use failoverInProgress and failbackInProgress as supported values for the status property on the cloudPC and cloudPcStatusSummary resources.

Files

• Added the userObjectId parameter to the getByUser method on the fileStorageContainer resource to retrieve a list of file storage containers owned by a user by passing the user's Microsoft Entra ID object ID.

Identity and access | Directory management

• Added the provision action to the device resource to enable approved Virtual Desktop Infrastructure (VDI) providers to provision devices in a customer's directory.

Identity and access | Governance

Clarified that the Get accessPackageResourceEnvironment method returns SharePoint Online resource environments only when it's called with delegated permissions. A SharePoint Online resource environment corresponds to a SharePoint root site, so to retrieve root site information with application permissions, use the List sites method with the $filter=siteCollection/root ne null query option.

People and workplace intelligence | Analytics

Added the sensitivityLabel property to the searchHit resource type to provide sensitivity-label information for the search result resource.

Security | Data security and compliance

Added the contentFiltering member to the userActivityTypes enumeration used by the compute protection scopes for a user and compute protection scopes for a tenant APIs, enabling applications to determine whether data loss prevention policies govern content filtering before evaluating content.

Updated the contentActivity resource to support reporting Secure by Default policy evaluations that couldn't be completed. Enforcement planes can submit structured incomplete-inspection reasons through the existing content activity ingestion API.

Security | Audit log query

• Added the isRecordCountLimitExceeded, recordCountLimit, and approximateReturnedRecordCount properties to the auditLogQuery resource. Use these properties to determine whether a completed query exceeded the per-search record-count limit and to inspect the applicable limit and approximate returned record count.

Teamwork and communications | Messaging

Updated the getAllRetainedMessages method to document support for retained private-channel message versions captured after the tenant's private-channel storage migration completed.

August 2026: New and generally available

Applications

• Added the authenticationBehaviors resource type and the coopEnforcement property to the v1.0 endpoint. Application owners can use the property to explicitly test Cross-Origin-Opener-Policy enforcement, temporarily suppress enforcement while remediating an incompatible browser authentication flow, or return to the service default. The property is available in the global service only and isn't available in national cloud deployments.
• Added the authenticationBehaviors property to the application resource type in v1.0. Returned only on $select.

Change notifications | Subscription

• Added support for delivering change notifications to Web Push endpoints (RFC 8291) for the subscription resource type.
• Added the getVapidPublicKey method to obtain the VAPID public key (RFC 8292) used when creating Web Push subscriptions.

Files

• Added the Upsert columns method to the fileStorageContainer resource type to create or update up to 20 columnDefinition objects in a single request.
• Added the appliedByUser parameter to the assignSensitivityLabel action on the driveItem resource. This parameter allows app-only callers to specify the user identity on whose behalf the sensitivity label is applied.

Identity and access | Directory management

• Added the managerApplications property to the agentIdentity and agentIdentityBlueprintPrincipal resources to identify the applications that manage the backing agent identity blueprint.

Added the recovery resource type and related methods to programmatically recover critical Microsoft Entra directory objects from automatically created point-in-time snapshots. Use these APIs to inspect available snapshots, preview and scope changes before restoration, run recovery jobs, monitor progress, and review failed changes.

Identity and access | Governance

• Added the externalSapAcConnectionInfo complex type, along with the supporting authenticationInfo and clientCredentialAuthenticationInfo types, to configure connections from Microsoft Entra entitlement management to SAP Access Control (AC) systems. Set these on the connectionInfo property of an externalOriginResourceConnector when its connectorType is sapAc.
• Promoted the Lifecycle Workflows provisioning and workflow subject APIs from beta to v1.0, introducing a broader, extensible subject model for workflows and surfacing per-subject processing results. The promoted surface includes:
  • workflowSubject base type and its provisioningObjectWorkflowSubject and directoryObjectWorkflowSubject derived types
  • subjectProcessingResult resource with the subjectProcessingResults navigation property on the run and workflow resources
  • subjectSummary resource and the summary method on the subjectProcessingResult resource
  • activateAndWait action on the workflow resource, returning the awaitedWorkflowProcessingResult resource
  • provisioningAttributeMapping and attributeSetEntry resources
  • customTaskExtensionResponseData resource, the replyMode property on customTaskExtension, and the targetSubject property on customTaskExtensionCalloutData
  • targetSubjectType property on workflowBase and workflowSubject property on taskProcessingResult
  • subjectType and customTaskExtensionReplyMode enumerations, along with the extensibility and extensibilityOnDemand enumeration members
• Added the externalOriginResourceConnector resource type and methods to create, list, get, update, and delete connections from Microsoft Entra entitlement management to SAP Identity Access Governance (SAP IAG). For an SAP IAG connector, specify the SAP IAG endpoint, OAuth token endpoint, and client ID, along with the Azure subscription, resource group, key vault, and secret that identify where its client secret is stored. The connector is associated with an access package resource so that entitlement management can provision access to resources in SAP IAG through access packages.
• Added the reviewerId and scopeType properties to accessReviewReviewerScope to specify a reviewer directly or as a well-known scope instead of through a query.
• Added the applyDescription property to accessReviewInstanceDecisionItem to describe the result of applying a decision.
• Added the appRoleId and appRoleDisplayName properties to accessReviewInstanceDecisionItemServicePrincipalResource to identify the app role under review.
• Added the errors property to accessReviewInstance and the accessReviewError resource type to report errors that occur during the review instance lifecycle.
• Added the accessReviewPrincipalScope, accessReviewResourceScope, and accessReviewAccessPackageAssignmentPolicyScope resource types. Use them in the principalScopes and resourceScopes properties of principalResourceMembershipsScope to state which principals have their access to which resources reviewed without writing a query expression.
• Added the accessReviewPrincipalScopeType, accessReviewResourceScopeType, and accessReviewReviewerScopeType enumeration types to identify well-known principal, resource, and reviewer scopes.

Identity and access | Identity and sign-in

Added support for managing Microsoft 365 cross-tenant capabilities in cross-tenant access policies. Use the m365CapabilityBase resource and the m365Capabilities relationship to manage which Microsoft 365 experiences—such as calendar sharing, MailTips, places booking, and cross-tenant migration—are enabled between tenants. For the default policy, you can list, create, and update capabilities. For partner policies, you can list, create, update, and delete capabilities.

Mail

• Added the note resource type and methods to list, create, get, update, and delete quick-capture notes in a user's Notes folder. Use delta query to synchronize notes that were added, updated, or deleted since the previous request. You can also list, add, and delete inline image attachments, and use open or legacy extended properties to store custom data on a note.

Mailbox import and export

• Added the wellKnownName property to the mailboxFolder resource type in v1.0. Use this property to identify folders created by Outlook by using a locale-independent name.
• Added the Delete mailboxItem method to the mailboxItem resource type in v1.0. Use this method to delete an individual mailbox item from a mailbox folder with Exchange soft-delete or hard-delete semantics.

Security

Updated the retirement date for the legacy Microsoft Graph security alerts API from August 31, 2026 to October 15, 2026.

Identity and access | Monitoring & health

• Added support for tagging Microsoft Entra recommendations and their impacted resources. Use the recommendation: addTag, recommendation: removeTag, impactedResource: addTag, and impactedResource: removeTag methods to manage the tags relationship, backed by the new recommendationTag resource. You can also add or remove a tag on up to 50 impacted resources in a single request by using the impactedResource: addTag and impactedResource: removeTag methods.
• Added alternate remediation states for recommendations and impacted resources. Use the markPlanned, acceptRisk, and applyAlternateMitigation methods on the recommendation resource, and the corresponding methods on the impactedResource resource.
• Added the needsMoreAction member to the recommendationStatus enumeration, and the critical member to the recommendationPriority enumeration.
• Added the nistClassification resource and the nistClassifications property to the recommendationBase resource to map recommendations to NIST Cybersecurity Framework 2.0 functions and categories.
• Added the categoryGroup property (and the new recommendationCategoryGroup enumeration), completedBySystemDateTime, completedByUserDateTime, failedReviewDateTime, needsMoreActionResourceCount, remediatedDateTime, and statusModifiedDateTime properties to the recommendationBase resource. Added the microsoftEntraSuite member to the requiredLicenses enumeration and the lastRefreshedDateTime property to the recommendationConfiguration resource.

Teamwork and communications | Calls and online meetings

• Updated the getAllRecordings and getAllTranscripts methods to document a service-update issue that can cause paginated requests to return an empty collection followed by duplicate items.
• Updated the getAllRecordings method to return a Microsoft Graph URL that you can use to download recording content.

Tenants | Tenant governance

• Promoted the tenantGovernance resource type and related methods from beta to v1.0 for discovering related tenants and managing governance invitations, requests, relationships, settings, and policy templates across Microsoft Entra tenants.

August 2026: New in preview only

Applications

• Added the coopEnforcement property to the authenticationBehaviors resource. Application owners can use it to explicitly test Cross-Origin-Opener-Policy enforcement, temporarily suppress enforcement while remediating an incompatible browser authentication flow, or return to the service default.

Device and app management | Cloud licensing

Added cloud licensing support for devices, enabling license assignment and usage tracking for device-based licensing scenarios. The new capabilities include:

• Added the deviceCloudLicensing resource type and the cloudLicensing property to the device resource.
• Use the List usageRights for device method to retrieve usage rights granted to a device through direct assignments and transitive group-based assignments.
• Use the Create assignment for device method to assign licenses directly to devices.
• Use the List waitingMembers for device method to retrieve devices in the waiting room due to license capacity limits.

Device and app management | Cloud PC

• Added the retrieveCloudPcPerformanceMetricsReport method to the cloudPcReports resource type. Use it to get VM-level utilization and performance metrics for a specific Cloud PC, including CPU, memory, and network metrics.

Files

• Added the Upsert columns method to the fileStorageContainer resource type to create or update up to 20 columnDefinition objects in a single request.
• Added the appliedByUser parameter to the assignSensitivityLabel action on the driveItem resource. This parameter allows app-only callers to specify the user identity on whose behalf the sensitivity label is applied, enabling label assignment for SharePoint Embedded containers.

Identity and access | Governance

• Added support for configurable time-based lifecycle workflow triggers through the timeBasedAttributeTriggerV2 resource. Select a date-type user attribute and configure an operator to run workflows on an exact date, within a rolling window, or between two offsets before or after that date.

Identity and access | Identity and sign-in

• Added the anonymousCalendarSharingFreeBusySimple, anonymousCalendarSharingFreeBusyDetail, and anonymousCalendarSharingFreeBusyReviewer capabilities that derive from m365CapabilityBase. Use these capabilities in cross-tenant access policies to authorize anonymous external users to view calendar free/busy information at simple, detailed, or reviewer fidelity.

Mail

• Changed the members property on the distributionList resource to an expandable relationship. Use $expand=members with the Get distribution list method instead of the removed standalone methods for listing and getting members.

People and workplace intelligence

• Updated Manage profile source precedence in Microsoft 365 to clarify supported data sources for HR and work position data, explain how source precedence affects single-value versus multi-value properties, and add guidance on correctly configuring and removing tenant-level settings using the Microsoft Graph API or PowerShell.
• Added the People data sources in Microsoft 365 concept article that describes the data sources that build the Microsoft 365 user profile, including Microsoft Entra ID, Copilot connectors, Organizational data, SharePoint, People Skills, user edits, and the API user source. The article also provides a reference table of built-in source IDs (GUIDs) and explains how source metadata appears in the profile API output.

Security | Advanced hunting

• Added the getHuntingSchemaTables function to the security resource. Use it to retrieve only the advanced hunting tables that the signed-in user can access, returned as a collection so that you can apply OData query parameters to request a targeted subset of tables and columns.

Security | Alerts and incidents

• Added the createAlert action to the alert resource for creating Microsoft 365 Defender alerts programmatically, including alert properties, incident-linking options, workspace routing, and inline entity definitions in a single request.

Security | Case management

• Added the slaPolicies property to the case resource type, a read-only collection of caseSlaPolicyEntry objects that report the current status and breach target time of each SLA policy applied to a case.
• Added the download attachment content and upload attachment content methods to the attachment resource type to transfer case evidence in chunks and retrieve it after malware scanning.
• Added the get relation and delete relation methods to the relation resource type to read and remove links between a case and related security resources.
• Added the delete task method to the task resource type to remove a task from a case.

Security | Data security and compliance

• Added the privacyDataMatch, aiPowered, and unknownFutureValue members to the classificationMethod enumeration for the sensitiveType resource. These members support privacy data matching based on tenant data, AI-powered classification that can benefit from supported caller-supplied embeddings, and forward-compatible handling of future values.
• Replaced the offsetChunks property and embeddingOffsetChunk resource type with the chunkOffsets property and chunkOffsets complex type in embeddingInput. Use chunkOffsets to associate precomputed embedding vectors with their source text ranges by using base64-encoded start positions and lengths.

Teamwork and communications | Calls and online meetings

• Updated the getAllRecordings and getAllTranscripts methods to document a service-update issue that can cause paginated requests to return an empty collection followed by duplicate items.

Teamwork and communications | Messaging

• Added the agentCommunicationConfiguration resource type and related methods to configure how agents send and receive messages in Microsoft Teams. Define default communication settings on an agentIdentityBlueprint and override them for a specific agent on agentIdentity.
• Added the reorder sections and reorder section items actions. Use these actions to apply a complete custom order to a user's sections or to the items in a user-defined section.

Contribute to Microsoft Graph

Are there scenarios you'd like Microsoft Graph to support?

• Suggest and vote for new features by using the Microsoft Graph Feedback Portal. Some new features originate as popular requests from the developer community. The Microsoft Graph team regularly evaluates customer needs and releases new features to the beta (https://graph.microsoft.com/beta) and v1.0 (https://graph.microsoft.com/v1.0) endpoints.

• Join the weekly Microsoft 365 platform community call and become an active member of the Microsoft Graph community. To discover the full calendar of developer calls, visit the Microsoft 365 and Power Platform community page.

• Join our research panel to provide your input on our developer experiences.

Related content

• Microsoft Graph developer blog.
• Microsoft Graph API changelog.
• Microsoft Graph what's new history.