(Updated) Retirement of default app-only consistency in Microsoft Entra

Updated May 8, 2026: We have updated the content and timeline. Thank you for your patience. 

Upcoming change: Disabling default app-only consistency for Microsoft Entra Graph APIs

To scale reliably and remain resilient during failures, Microsoft Entra uses an eventually consistent directory model. We are making a change to Microsoft Entra Graph APIs to disable the default app-only consistency behavior. App-only token flows are meant for background non-user interactive requests, which don't have a signed-in user context and don’t require consistency.

When this will happen

General Availability: We will retire the default app-only consistency feature from Entra starting June 30th, 2026 (was previously planned for May 31st).

Scream test notification

To help identify applications that may be affected before the final rollout, we will conduct limited-duration scream tests prior to the final rollout.

• First week of July 2026: A controlled scream test lasting approximately 6 hours
• Second week of July 2026: A controlled scream test lasting approximately 24 hours

During these periods, the default app-only consistency behavior will be disabled for all applications. These tests are intended to help customers validate application behavior and identify any remaining dependencies on the previous default consistency behavior.

No additional changes related to this feature will be deployed outside of these scheduled test windows prior to the end of the temporary exclusions on June 30, 2026.

How this will affect your organization

This is a breaking change for applications using app-only access with Microsoft Entra Graph APIs that rely on the default consistency of behavior. App-only queries that are trying to read or write immediately after a write may return different results after this change. Delegated (user-based) access is not affected.

What you need to do to prepare

Review applications that use app-only access with Microsoft Entra Graph APIs. Identify queries that rely on previous default consistency behavior and update them. We recommend validating application behavior and completing any required updates before June 30th, 2026, to avoid potential disruptions.

How to test the fixes

Include the following request header when calling Microsoft Entra Graph APIs:

• ConsistencyLevel: Eventual

Setting this header produces the same behavior as having app-only consistency disabled by Entra ID. This lets you validate your scenarios in advance — if everything works with the header in place, it will also work once consistency is disabled for your application.

Why some customers experienced impact earlier

On April 20, we rolled out this change for a subset of applications who, based on telemetry, were identified as unlikely to be impacted. Some customers affected by this change were not accurately identified by our telemetry, leading to unintended service interruptions for a small subset of scenarios.

1. Impacted applications are being added to a temporary exclusion list through June 30, 2026.
2. On April 28, we expanded the exclusion list based on telemetry, significantly reducing the number of applications that could experience impact.

Guidance

Designing for Eventual Consistency for Microsoft Entra | Microsoft Entra Identity Platform

Learn More: Architecture overview - Microsoft Entra | Microsoft Learn