Blog Post

Microsoft Entra Blog
4 MIN READ

Azure AD: Change Management Simplified

ShobhitSahay's avatar
ShobhitSahay
Icon for Microsoft rankMicrosoft
Mar 01, 2022

Editor's Note: This is not the blog you are looking for...

You're probably not looking for feature information from 2022, are you?  Here are a few links that might be more aligned with your needs:

Azure Active Directory (Azure AD) is now known as Microsoft Entra ID.  For information about the name change, please read: New name for Azure Active Directory - Microsoft Entra | Microsoft Learn.

------------------

 

Update: Update December 15th, 2022: ADAL end of support is now extended to June 30th, 2023. We will retire AAD Graph API any time after June 30th, 2023. Through the next six months (January 2023 – June 2023) we will continue informing customers about the upcoming end of support along with providing guidance on migration.

 

Hello Everyone, 

 

Rapid change is a growing reality in cloud services. In Azure AD alone, we are making hundreds of changes every year including new feature releases, changes to existing features, as well as deprecations and retirements. We’ve heard from our customers that managing these changes is becoming increasingly difficult so, starting today, we are simplifying change management for Azure AD.  

 

While we will continue to bring new capabilities to you throughout the year, feature deprecations and product retirement communications will be announced as part of bi-annual communication trains that will occur every March and September, with consistent end-of-support timelines (with some exceptions). With this new model, you’ll have predictable product and feature changes, making it easier to accelerate the adoption of newer and more secure technologies.  

 

Here’s the list of deprecation announcements that are part of the March 2022 train: 

 

  • We will retire the Azure AD Graph API any time after June 30th, 2023.   Listening closely to your feedback about the challenges of migrating such a critical dependency, we’re extending the retirement date. For more information, see Migrate Azure AD Graph apps to Microsoft Graph - Microsoft Graph | Microsoft Docs. 
  • We will continue to retire the Azure AD Graph and MSOnline PowerShell licensing assignment APIs and PowerShell cmdlets on August 26, 2022. Please migrate your apps to access the license managements APIs from Microsoft Graph. For more information, visit Migrate your apps to access the license managements APIs from Microsoft Graph - Microsoft Tech Community 
  • We stated before that if you’re using the Azure AD PowerShell or MSOnline PowerShell modules to manage Azure AD, we encourage you to try the Microsoft Graph PowerShell SDK. The Microsoft Graph PowerShell SDK continues to be where all our current and future PowerShell investments are being made. In light of the announcement to not turn off the Azure AD Graph API on June 30th, our goal is to also provide guidance and tools for migrating existing scripts and PowerShell processes, reliant on the Azure AD Graph API and MSOnline module, to the Microsoft Graph PowerShell SDK. This is due to the planned deprecation of the two PowerShell modules (MSOL & AAD) after December 2022. Check out more information here and here. 
  • ADAL end of life is extended from December 30th, 2022, to June 30th, 2023. While ADAL apps may continue to work, no support or security fixes will be provided past end of life.  In addition, there are no planned ADAL releases planned prior to end of life for features or support for new platform versions. For more information, see Update your applications to use Microsoft Authentication Library and Microsoft Graph API - Microsoft Tech Community 
  • We have begun the legacy TLS 1.0 and 1.1 protocol deprecations for the pPublic cloud and will continue with a gradual roll out of the deprecation over the course of this year. For more information see  Enable TLS 1.2 support as Azure AD TLS 1.0/1.1 is deprecated - Active Directory | Microsoft Docs 
  • We will begin retiring past versions of Azure AD Connect Sync 12 months from the date they are superseded by a newer version. To upgrade your Azure AD Connect Sync server, follow these steps: Azure AD Connect: Upgrade from an earlier version  
  • We will enable combined MFA and SSPR security information registration for all non-enabled tenants created before Aug 2020. More information on this experience can be found here: Combined registration for SSPR and Azure AD Multi-Factor Authentication - Azure Active Directory | Microsoft Docs
  • The Azure Key Vault Team is working on enforcing soft delete protection on all key vaults to ensure that customer secrets, keys, and certificates are protected from accidental deletion. Soft Delete is a feature that allows deleted key vaults and secrets stored inside key vault to remain recoverable for a period of up to 90 days and allows customers to restore deleted secrets in a self-serve process. All existing key vault resources will have soft delete automatically enabled by February 1, 2025. Enabling soft delete is a one-way operation. Once enabled, the feature cannot be disabled. Learn more here: Soft-delete will be enabled on all key vaults 

 

2022 Change Communication Timeline:

 

----------------------------------------------------------------------------------------------------------

 

Learn more about Microsoft identity: 

Updated May 12, 2025
Version 5.0
Product Announcements
ShobhitSahay's avatar
Icon for Microsoft rankMicrosoft
Joined October 17, 2018
View Profile
Microsoft Entra Blog
Stay informed on how to secure access for employees, customers, and non-human identities, from anywhere, to multicloud and on-premises resources, with comprehensive identity and network access solutions powered by AI.

28 Comments

Show More
  • ChrisAtMaf's avatar
    ChrisAtMaf
    Iron Contributor
    Mar 09, 2022

    Further to my comment above, announcing the deprecation of the MSOL and Azure modules in December 2022 when there are still known limitations and key functionality still in beta, and you haven't even written the guidance and tools for migrating existing scripts to the product intended to replace them, is just disrespectful to your customer's patience and time.

  • ChrisAtMaf's avatar
    ChrisAtMaf
    Iron Contributor
    Mar 09, 2022

    As mentioned before, it's quite frustrating that the automation interfaces for Azure and Microsoft 365 are in a constant state of flux. As something to bear in mind, system administrators are not developers. We don't expect API calls etc to change every 5 minutes. In the past, Windows tools such as cmd.exe, VBScript and other automation instances have worked across all versions of Windows, with backwards compatibility a priority. When it comes to Microsoft 365 / Azure, we've been through four incomplete iterations:

    • The MSOnline module, which is *still* required for stable access to MFA (support under Microsoft Graph is still in beta - I'm sorry, but having used beta endpoints in the past, they are subject to change at any point, so there's no point investing time in updating scripts until they are released to general availability.)
    • The AzureAD module, which is buggy and often doesn't seem to support pipelining properly (try piping things into Get-AzureADUser, for example).
    • The AzureAD module cmdlets which are identical to existing ones but use MS Graph (e.g. Get-AzureADMSGroup) and are necessary to get all functionality
    • Now the plethora of MS Graph modules

    Why do we have to keep updating our scripts to keep existing functionality working? Why can't you improve and evolve rather than continuously trying to reinvent the wheel?

    We all know that it would be possible (although a fair amount of work) to ensure backwards compatibility for these modules - keep the modules the same, but update the back end to use Microsoft Graph. In the past this would have been Microsoft's approach (read Raymond Chen's 'The Old New Thing' for how much work Microsoft used to put in to avoid these kinds of issues in previous Windows releases). Not ensuring backwards compatibility is one of the mistakes that led to the huge backlash for products like Microsoft Vista. Indeed it seems that the Windows team still understand this - when will Microsoft's cloud services teams learn? By all means progress with new technologies like Microsoft Graph - but don't forget the backwards compatibility religion. It's why many of us continue to choose Microsoft products - but if that benefit is taken away, why should we remain?

  • Charl Pels's avatar
    Charl Pels
    Copper Contributor
    Mar 08, 2022

    Would be nice to have an option to disable the Azure AD Graph API in an environment and if needed enable it again. So we can make shure we don't mis anything and if so can use the time to correct it and try/disable the API again.

  • Ian Clarke's avatar
    Ian Clarke
    Copper Contributor
    Mar 04, 2022

    Hi 

     

    Regarding Azure AD Graph API and the extension for 6 months. Does this mean that editing current API permissions is still not available?  Mine still seems to be greyed out when accessing this module?

     

    Thanks

  • bafusco's avatar
    bafusco
    Copper Contributor
    Mar 03, 2022

    > the planned deprecation of the two PowerShell

    > modules (MSOL & AAD) after December 2022

     

    Does this mean we will finally be able to access default MFA method through other means besides the MSOL module sometime soon? The most recent update that I've seen was a change to the https://docs.microsoft.com/en-us/graph/api/resources/authenticationmethods-overview?view=graph-rest-beta that indicates the MSOL module is the only way to get/set this info.

  • MikeCrowley's avatar
    MikeCrowley
    Iron Contributor
    Mar 02, 2022

    2025? Why so far out for the Azure key vault, we'll all be driving flying cars by then.

  • PeterJoInobits's avatar
    PeterJoInobits
    Brass Contributor
    Mar 02, 2022

    Hi Team

     

    Shouldn't this: "We will enable combined MFA and SSPR security information registration for enabled tenants created before Aug 2020. More information on this experience can be found here: " actually read "We will enable combined MFA and SSPR security information registration for all non-enabled tenants created before Aug 2020. More information on this experience can be found here" 

     

    I'm assuming that this statement is meant to mean that all tenants created before Aug 2020 will have the feature enabled automatically by Microsoft on the backend. Or do I have it wrong.?