Microsoft Graph: New tenant controls for retirement of non-standard file API tokens

Microsoft will retire pre-authenticated (tempauth) URLs in SharePoint Online and OneDrive by April 1, 2027. New tenant controls will allow admins to test updated Microsoft Graph URL behavior using Microsoft Entra ID authentication. Apps must stop relying on embedded auth URLs and HTTP 302 redirects. Validation before the deadline is recommended. Microsoft is retiring pre-authenticated URLs, also known as tempauth URLs, from SharePoint Online and OneDrive. Beginning April 1, 2027, selected Microsoft Graph file APIs will no longer return URLs that contain embedded authentication information and will no longer issue HTTP 302 redirects to those URLs. To help organizations prepare, new SharePoint Online tenant controls are coming soon in a future release of Microsoft SharePoint Online PowerShell. These controls will allow administrators to enable updated Microsoft Graph URL behavior for specific applications before the retirement date. This gives organizations time to validate application compatibility, improve security posture, and transition to standard Microsoft Entra ID authentication before the change takes effect. Rollout schedule Service change (Worldwide, GCC, GCC High, DoD): Beginning in early April 2027 and expected to complete in late April 2027 Impact on your organization Who is affected Administrators responsible for Microsoft Graph, SharePoint Online, OneDrive, application integrations, and tenant security Owners of third-party applications, line-of-business applications, custom applications, and automation solutions that use affected Microsoft Graph file APIs Organizations using applications that follow redirects or rely on URLs containing embedded authentication information Platforms and services Microsoft Graph SharePoint Online OneDrive Microsoft Entra ID Third-party and custom applications that consume Microsoft Graph file APIs What will happen Applications using affected Microsoft Graph APIs may currently receive: SharePoint Online download, upload, monitor, preview, version, or similar URLs that contain temporary authentication information. Media service URLs that contain temporary authentication information. HTTP 302 redirects to URLs containing embedded authentication information. After the change: Applications configured to use supported Microsoft Graph URL alternatives will receive Microsoft Graph URLs and continue authenticating with Microsoft Graph access tokens. APIs that currently return HTTP 302 redirects to temporary authentication URLs will instead return content directly. SharePoint Online URLs returned by affected APIs will no longer […]

The post Microsoft Graph: New tenant controls for retirement of non-standard file API tokens appeared first on M365 Admin.