Defender advanced hunting APIs stop working on 1 February 2027

Defender advanced hunting APIs stop working on 1 February 2027

26 October 2026: Microsoft will switch off the advanced hunting APIs of Defender for Endpoint and Defender XDR on 1 February 2027. Anything that still sends Kusto queries to them after that date, a SIEM connector, a threat-hunting notebook, a scheduled export or a SOAR playbook, will stop getting answers. The replacement is the advanced hunting endpoint of the Microsoft Graph security API, and Microsoft says nothing will be migrated automatically.

Not yet independently verified. Microsoft's documentation confirms the retirement but gives no day; the 31 January and 1 February 2027 dates come from Message Center notice MC1220762, which we read through a public mirror. We will update this when it can be confirmed, and remove this note.

Microsoft first announced the retirement in January in Message Center notice MC1220762 and sent its fourth reminder on 26 October.

The dates in the notice

• 6 February 2026: retirement began
• 31 January 2027: the last day to move integrations
• 1 February 2027: both APIs stop working

Microsoft's documentation for the Defender XDR API now opens with a warning that it describes an older version and that once retirement is complete "the Microsoft Defender XDR advanced hunting API no longer functions". The page still documents the old call, a POST to api.security.microsoft.com/api/advancedhunting/run with the AdvancedHunting.Read.All permission, which is the quickest way to find code that depends on it.

What a migration involves

The Graph endpoint takes the same Kusto queries, so most hunting logic carries over unchanged. The work sits around it: a new app registration permission on Microsoft Graph, a different URL and response shape, and different throttling. Teams should test the queries that return the most rows, since limits and timeouts are where results are most likely to differ. Running old and new calls side by side for a few weeks before the cut-off, and comparing row counts, catches most of those differences while the old endpoint still answers.

Who should check now

Security teams that pull Defender data into a third-party SIEM or data lake through a vendor connector should ask the vendor which API the connector calls and when it will change; connectors built before 2026 are the likely holdouts. In-house scripts written by former staff are the other common gap, because they tend to run quietly until they fail. Our catalogue lists 15 SIEM products and 12 endpoint detection and response products, many of which offer Defender connectors of this kind.

Sources

• Microsoft Learn: Microsoft Defender XDR advanced hunting API (updated 20 October 2026), 20 October 2026
• Microsoft 365 Message Center MC1220762 (update of 26 October 2026), via the mc.merill.net mirror, 26 October 2026