MC1492958 - Microsoft Graph: New tenant controls for retirement of non-standard file API tokens

Microsoft 365 Message Center announcement MC1492958.

Message Center ID

MC1492958

Category

plan For Change

Severity

normal

Services

SharePoint Online

Tags

User impact, Admin impact, Retirement

Published

2026-10-09

Last updated

2026-10-09

Expires

2027-05-30

Action required by

2027-04-01

[What and why] Microsoft is retiring pre-authenticated URLs, also known as tempauth URLs, from SharePoint Online and OneDrive. Beginning April 1, 2027, selected Microsoft Graph file APIs will no longer return URLs that contain embedded authentication information and will no longer issue HTTP 302 redirects to those URLs. To help organizations prepare, new SharePoint Online tenant controls are coming soon in a future release of Microsoft SharePoint Online PowerShell. These controls will allow administrators to enable updated Microsoft Graph URL behavior for specific applications before the retirement date. This gives organizations time to validate application compatibility, improve security posture, and transition to standard Microsoft Entra ID authentication before the change takes effect. [Rollout schedule] Service change (Worldwide, GCC, GCC High, DoD): Beginning in early April 2027 and expected to complete in late April 2027 [Impact on your organization] Who is affected Administrators responsible for Microsoft Graph, SharePoint Online, OneDrive, application integrations, and tenant security Owners of third-party applications, line-of-business applications, custom applications, and automation solutions that use affected Microsoft Graph file APIs Organizations using applications that follow redirects or rely on URLs containing embedded authentication information Platforms and services Microsoft Graph SharePoint Online OneDrive Microsoft Entra ID Third-party and custom applications that consume Microsoft Graph file APIs What will happen Applications using affected Microsoft Graph APIs may currently receive: SharePoint Online download, upload, monitor, preview, version, or similar URLs that contain temporary authentication information. Media service URLs that contain temporary authentication information. HTTP 302 redirects to URLs containing embedded authentication information. After the change: Applications configured to use supported Microsoft Graph URL alternatives will receive Microsoft Graph URLs and continue authenticating with Microsoft Graph access tokens. APIs that currently return HTTP 302 redirects to temporary authentication URLs will instead return content directly. SharePoint Online URLs returned by affected APIs will no longer contain embedded temporary authentication information. Applications accessing SharePoint Online URLs directly will need a valid Microsoft Entra ID access token for the SharePoint Online resource. Requests made directly to SharePoint APIs rather than through Microsoft Graph are not affected by the tenant control setting. Applications that store, inspect, or redeem URLs containing embedded authentication tokens may stop functioning if not updated before April 1, 2027. The change is not enabled by default through tenant controls. Administrators must choose which application IDs participate in testing and validation. Affected API families include: File download and content APIs createUploadSession APIs Copy APIs and long-running action monitors Preview APIs Thumbnail APIs Version APIs Format conversion APIs [Action required and recommendations] Administrators should begin validation before April 1, 2027. Recommended actions: Identify applications that obtain file, version, thumbnail, preview, upload-session, or copy-operation URLs through Microsoft Graph. Review whether applications inspect, store, or redeem URLs containing embedded authentication information. Verify that applications can process direct content responses instead of relying on HTTP 302 redirects. Confirm applications can obtain and send the appropriate Microsoft Entra ID access token when calling Microsoft Graph or SharePoint Online endpoints. Enable the new tenant setting for a limited set of application IDs and validate application behavior. Monitor application errors, authentication failures, and sign-in activity during testing. Expand the configuration to additional applications after successful validation. Contact application vendors and internal application owners to confirm support plans and timelines for affected applications. Communicate this upcoming change to development and application support teams. No action is required if: Your organization does not use the affected APIs. Applications already use direct Microsoft Graph content endpoints and standard Microsoft Entra ID authentication. Learn more Clear-SPOTenantPreAuthSettings (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn Get-SPOTenantPreAuthSettings (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn Get started with the SharePoint Online Management Shell | Microsoft Learn OAuth 2.0 and OpenID Connect protocols - Microsoft identity platform | Microsoft Learn Pre-authenticated (tempauth) URLs are retiring: move to Microsoft Entra ID tokens before April 1, 2027 - Microsoft 365 Developer Blog [Compliance considerations] Question Answer Does the change include an admin control, and can it be controlled through Entra ID group membership? Yes. New SharePoint Online tenant controls are being introduced to allow administrators to opt specific application IDs into the updated authentication behavior before the retirement date. Customers should review documentation to determine available scoping and configuration options. Regarding controlled by EntraID Group membership, I do not think that applies. These are SharePoint Online PowerShell cmdlets.