[Announcement] Azure AD Graph API retirement: action required if you're on an old Azure PowerShell release #30253

Summary

Azure AD Graph API (the legacy graph.windows.net API
entered its retirement process in September 2024, with the general shutdown completed on
July 1, 2025. Azure PowerShell completed its migration away from Azure AD Graph well ahead of
that deadline — identity-related cmdlets have been backed by Microsoft Graph since
Az.Resources version 5.1.0. If you are running a current version of Azure PowerShell,
no action is required.

This issue is for customers still running an old, unsupported release that may still depend on
Azure AD Graph.

Why you're seeing this now

Because Azure PowerShell is a Microsoft first-party client, its Azure AD Graph application identity
has remained available temporarily, purely to give very old releases a transition buffer. This does
not mean those old releases are supported — they have long been out of maintenance. Beginning
after October 6, 2026, the Microsoft Entra team will progressively disable this remaining
legacy access over a two-month period. Old Azure PowerShell releases that still depend on Azure AD
Graph may stop working at any point during this phased shutdown.

Am I affected?

You are only affected if you are running Az.Resources older than 5.1.0 (or an equivalently
old Az module release). Check your version with:

Get-InstalledModule -Name Az.Resources

If you're on 5.1.0 or later, you are already using Microsoft Graph and this does not apply to you.

Separately, if you are still using the standalone legacy AzureAD or MSOnline PowerShell
modules (distinct from the Az module), those were already deprecated on their own timeline and
have their own migration path to the Microsoft.Graph PowerShell cmdlets — updating Az alone
will not resolve that.

What to do

If you're on an old release:

1. Upgrade to the latest Azure PowerShell (Az module) as soon as possible:
   Install or update Azure PowerShell
2. Check CI/CD pipeline images, automation runbooks, and any pinned/containerized environments —
   these are the most common places an old version silently persists even after developer
   machines have been updated.
3. If you're still on the legacy AzureAD/MSOnline modules, migrate to the Microsoft.Graph
   PowerShell SDK:
   Migrate from AzureAD and MSOnline to Microsoft Graph PowerShell
4. If you have custom scripts calling graph.windows.net directly (independent of Az), those
   will need to migrate to Microsoft Graph directly regardless of your Azure PowerShell version.

Questions or issues

If you believe you're on a current Azure PowerShell release but are still seeing Azure AD
Graph-related authentication errors, please comment on this issue or open a new issue with your
Az.Resources version and the exact error message.