Summary
Azure AD Graph API (the legacy graph.windows.net API
entered its retirement process in September 2024, with the general shutdown completed on
July 1, 2025. Azure CLI completed its migration away from Azure AD Graph well ahead of that
deadline — az ad commands have been backed by Microsoft Graph since Azure CLI 2.37.0.
If you are running a current version of Azure CLI, no action is required.
This issue is for customers still running an old, unsupported release that may still depend on
Azure AD Graph.
Why you're seeing this now
Because Azure CLI is a Microsoft first-party client, its Azure AD Graph application identity has
remained available temporarily, purely to give very old releases a transition buffer. This does
not mean those old releases are supported — they have long been out of maintenance. Beginning
after October 6, 2026, the Microsoft Entra team will progressively disable this remaining
legacy access over a two-month period. Old Azure CLI releases that still depend on Azure AD Graph
may stop working at any point during this phased shutdown.
Am I affected?
You are only affected if you are running Azure CLI older than 2.37.0. Check your version with:
If you're on 2.37.0 or later, you are already using Microsoft Graph and this does not apply to you.
What to do
If you're on an old release:
- Upgrade to the latest Azure CLI as soon as possible:
Install or update Azure CLI
- Check CI/CD pipeline images, automation runbooks, and any pinned/containerized environments —
these are the most common places an old version silently persists even after developer
machines have been updated.
- If you have custom scripts or tooling calling
graph.windows.net directly (independent of
az), those will need to migrate to Microsoft Graph directly regardless of your Azure CLI
version.
Questions or issues
If you believe you're on a current Azure CLI release but are still seeing Azure AD Graph-related
authentication errors, please comment on this issue or open a new issue with your az version
output and the exact error message.
Summary
Azure AD Graph API (the legacy
graph.windows.netAPIentered its retirement process in September 2024, with the general shutdown completed on
July 1, 2025. Azure CLI completed its migration away from Azure AD Graph well ahead of that
deadline —
az adcommands have been backed by Microsoft Graph since Azure CLI 2.37.0.If you are running a current version of Azure CLI, no action is required.
This issue is for customers still running an old, unsupported release that may still depend on
Azure AD Graph.
Why you're seeing this now
Because Azure CLI is a Microsoft first-party client, its Azure AD Graph application identity has
remained available temporarily, purely to give very old releases a transition buffer. This does
not mean those old releases are supported — they have long been out of maintenance. Beginning
after October 6, 2026, the Microsoft Entra team will progressively disable this remaining
legacy access over a two-month period. Old Azure CLI releases that still depend on Azure AD Graph
may stop working at any point during this phased shutdown.
Am I affected?
You are only affected if you are running Azure CLI older than 2.37.0. Check your version with:
If you're on 2.37.0 or later, you are already using Microsoft Graph and this does not apply to you.
What to do
If you're on an old release:
Install or update Azure CLI
these are the most common places an old version silently persists even after developer
machines have been updated.
graph.windows.netdirectly (independent ofaz), those will need to migrate to Microsoft Graph directly regardless of your Azure CLIversion.
Questions or issues
If you believe you're on a current Azure CLI release but are still seeing Azure AD Graph-related
authentication errors, please comment on this issue or open a new issue with your
az versionoutput and the exact error message.