Microsoft to Retire Defender Advanced Hunting APIs: What Security Teams Need to Know

Microsoft is preparing to retire the Microsoft Defender for Endpoint (MDE) Advanced Hunting API and Microsoft Defender XDR Advanced Hunting API, which will require organizations to move security integrations to the Microsoft Graph Security API before the retirement deadline. This change is part of Microsoft’s effort to consolidate security data access under a single API framework that offers broader visibility, a consistent schema, and improved scalability for security operations.

The challenge for enterprises is that existing scripts, automations, and custom integrations built on the legacy APIs will stop working after February 1, 2027. Microsoft has warned that it will not provide an automatic migration path, and security teams must manually update queries, workflows, and integrations. Organizations that delay the transition risk service disruptions, broken security automation, and reduced visibility into security events once the older APIs are retired.

To avoid those issues, Microsoft recommends migrating all Advanced Hunting workloads to the Microsoft Graph Security API ahead of the deadline. IT administrators should inventory API dependencies, update internal documentation, validate new query schemas, and ensure security operations, engineering, and development teams are prepared for this upcoming change. Administrators should complete the testing process well ahead of the cutoff date to prevent operational disruptions.

What does this change mean for enterprises?

For enterprises, this retirement is more than a routine API update. Many security operations teams use the Defender Advanced Hunting APIs to power threat hunting dashboards, SIEM integrations, automated incident response workflows, compliance reporting, and custom security analytics. Organizations that fail to migrate before the February 2027 deadline could experience broken automations, missing security telemetry, and disruptions to incident investigation processes. The impact is likely to be significant in environments that have developed custom scripts and integrations over several years and may not have complete visibility into API dependencies.

This announcement also reflects Microsoft’s broader strategy of consolidating security management around Microsoft Graph. Enterprises can move to a single security API to access data across multiple Microsoft security services through a more consistent interface, which will reduce the complexity of maintaining separate integrations. Over time, this can simplify development efforts, improve scalability, and make it easier to adopt new Microsoft security capabilities.

However, security and IT teams will need to identify affected workflows, validate query compatibility, adjust response parsing logic, and thoroughly test integrations before the retirement date. This migration effort may require considerable planning and resources, and organizations that start early can minimize operational risk and avoid last-minute disruptions. For many enterprises, this is an opportunity to modernize security automation while ensuring business-critical security processes remain reliable in the coming years.