Backout Plan for EWS to MS Graph API upgrade for SharePoint|sapiens
Microsoft has announced the retirement of Exchange Web Services (EWS) in Exchange Online, effective October 1, 2026. After this date, EWS-based integrations will no longer be supported. To ensure uninterrupted email functionality, all affected SharePoint|sapiens solutions must be upgraded to use the Microsoft Graph API. My question is this - if we upgrade to Graph and our SharePoint|sapiens solution goes sideways somehow, is backout / rollback to EWS an option? I realize we could only roll back until 10/1 since that's the EWS retirement date, but our leadership may request that we make our solution functional temporarily (if the upgrade causes a problem) by rolling back.Microsoft To Enforce WAM for Delegated Interactive Graph Sessions
In a GitHub post, Microsoft says that interactive Graph sessions using the default Microsoft Graph Command Line Tools app will use the Web Account Manager (WAM) in the future. Some administrators use older versions of the Microsoft Graph PowerShell SDK for continued access to browser-based authentication, but this won’t be possible once Microsoft makes the server-side change to enforce WAM on an undefined future date. Teams and Exchange Online also use WAM, apparently for better security. https://office365itpros.com/2026/08/28/interactive-graph-sessions-wam/New Graph Permissions Pose Questions for Microsoft 365 Tenants
Microsoft issues new granular Graph permissions on an ongoing basis. That’s good, but only if tenants use the permissions to replace wider permissions in apps and scripts. Three new permissions recently became available, including two to reduce what apps can do with user account objects. The question is how to discover when Microsoft releases new permissions so that a decision can be made whether to use the new permissions. https://office365itpros.com/2026/08/26/granular-graph-permissions-question/Purview DLP Blocks Sharing Files with Specific Domains or Users
A new DLP rule is available to control sharing of SharePoint and OneDrive files with selected domains and email addresses. The new rule supports an allow list (permit sharing) and can also specify a deny list (block sharing). The user interface takes a little getting used to, but when everything is configured and SharePoint has had a chance to respond to the block, the rule works and any attempt by a blocked user to use a sharing link is refused. https://office365itpros.com/2026/07/22/block-sharing-dlp-sharepoint/Allow Sensitivity Labels to be assigned to Groups using application-only permissions
We want to generate Microsoft 365 Groups using an Azure Function. We want to assign a Sensitivity Label to the new group. However, Microsoft Graph does not support updating the "assignedLabels" property with application-only permissions. Please add support for this scenario, or another way of automating the assignment of sensitivity labels to groups.
Graph /users query with mailboxSettings filters/expands excludes unlicensed users
Hello Microsoft Graph team, I would like to report what appears to be a bug in Microsoft Graph user queries involving mailboxSettings. Issue summary: When mailboxSettings is used in a filter or expand clause on /users, unlicensed users are not returned, even when they should match the filter. Example scenario: Filter used: mailboxSettings/userPurpose ne 'room' Observed behavior: Users without Exchange license/mailbox are excluded from results (or result set appears truncated to mailbox-enabled users). Expected behavior: All users should be considered in /users query evaluation. If a user has no mailbox settings, behavior should be consistent and documented (for example null handling), but those users should not be silently dropped from /users results unless explicitly filtered out by query semantics. Reproduction steps: In a tenant with mixed users: Licensed mailbox users Unlicensed users without mailbox Run a /users query that includes mailboxSettings in filter and/or expand. Compare returned users with a baseline /users query without mailboxSettings conditions. Notice unlicensed users disappear when mailboxSettings is involved. Sample request patterns: GET https://graph.microsoft.com/v1.0/users?$filter=mailboxSettings/userPurpose ne 'room' GET https://graph.microsoft.com/v1.0/users?$expand=mailboxSettings&$filter=mailboxSettings/userPurpose ne 'room'Primer: How to Use JSON Batching to Speed up Graph Processing
JSON batching is one of the most effective ways to speed up the processing of Graph API requests. Although it might seem complicated, once you understand how batches are put together and submitted to the Graph batch endpoint, it’s not that hard. JSON batching is of particular interest to large Microsoft 365 tenants that might need to process tens of thousands of accounts, mailboxes, groups, and so on. All explained here, along with a PowerShell script to show how it’s done. https://office365itpros.com/2026/07/21/json-batching-primer/How Permissions Creep Can Halt the Microsoft Graph PowerShell SDK
The Microsoft Graph PowerShell Command Line tools app is how people run Microsoft Graph PowerShell SDK cmdlets. The app can suffer from permissions creep, meaning that over time, the app accrues a set of delegated permissions used by people to access different types of Microsoft 365 and Entra ID information. All is fine until an internal limit is reached, at which point authentication fails and some permissions must be pruned. https://office365itpros.com/2026/07/23/permissions-creep-sdk/
Retrieve all Teams transcripts a bot has attended to using Graph API
Hi there, I've been struggling for a lot of time trying to get this done. Has anyone been able to achieve something like this ? I wanted to : 1- Get all the meetings and transcripts of the tenant 2- Filter on those where the bot was attending 3- Get the transcripts when available. 4- Add rules to restrict the bot's access Right now I am stuck with the OAuth : The application 'bot-transcript' asked for scope 'OnlineMeetings.Read.All' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'. But this permission was added, and really seems to exist. Right ? Thanks in advance for any kind of help you could give me.The Grief and Joys of New PowerShell Releases
A new version of the Microsoft Graph PowerShell SDK (V2.38) is available, as is a new version of the Exchange Online Management module. They don’t work well together. It’s annoying and beyond frustrating that two critical PowerShell modules in the Microsoft 365 ecosystem cannot work together. If anything, the situation is getting worse. On the upside, I found out about two cmdlets that I might never use – but who knows! https://office365itpros.com/2026/06/22/powershell-woes-and-cmdlets/
