Fix it now · Microsoft Deadline Calendar

Azure AD Graph (graph.windows.net) calls are failing

Microsoft retired the legacy Azure AD Graph API in 2025. Any script, integration or older vendor connector that calls graph.windows.net must move to Microsoft Graph (graph.microsoft.com). Search your scripts and app registrations for Azure AD Graph permissions.

Fix it now

  1. Search scripts and config files for graph.windows.net.
  2. In Entra app registrations, look for apps still requesting Azure AD Graph API permissions.
  3. Ask vendors of older connectors whether their product still depends on it.
  4. Update Azure CLI and Azure PowerShell (Az) on build servers, runbooks and CI images. Old releases still call Azure AD Graph, and Microsoft is now switching that last access off.
  5. Rewrite against Microsoft Graph with least-privilege permissions.

Why this keeps happening

Azure AD Graph sat underneath many older integrations, often inside vendor connectors nobody on campus wrote. When it was retired, the failure showed up wherever that connector ran. See the full Microsoft Deadline Calendar.

What breaks next

  1. Live nowFrom Oct 6, 2026
    Microsoft switches off the last Azure AD Graph access for old Azure CLI and Azure PowerShell releases over about two months; they may stop working at any point
    Who it hits: Automation pinned to an old Azure CLI or Az PowerShell version
    Source: Microsoft Azure Tools blog: Azure AD Graph API retirement, action required for older Azure CLI and Azure PowerShell (Oct 5, 2026)
  2. Already passed2025
    MSOnline (May 2025) and AzureAD (from mid-October 2025) PowerShell modules retired; cmdlets stopped working. Legacy Azure AD Graph API retired.
    Who it hits: Any script using Connect-MsolService, Get-MsolUser, Connect-AzureAD, Get-AzureADUser, or calling graph.windows.net
    Source: Microsoft Learn: Azure AD PowerShell migration FAQ (MSOnline retired May 30, 2025)

You'll fix this one. There are more coming.

Find your next break date in about five minutes. Your answers are scored in your browser.

Run the 5-minute Microsoft Deadline Check

Questions

How do we know if a vendor connector depends on it?
Check the app registration's API permissions in Entra for Azure AD Graph, and ask the vendor directly whether their current release calls graph.windows.net.
Is there a quick compatibility option?
Microsoft's Entra PowerShell module was built to ease migration from AzureAD cmdlets. Test it, but don't treat it as permanent.

Related fixes

Request a Demo