# Microsoft Graph Toolkit Retires: PnPjs vs Graph SDK | AvantIT > Microsoft Graph Toolkit retires on August 28, an actively exploited SharePoint CVE, EWS on a clock, and how to choose between PnPjs and the Graph SDK. Canonical: https://www.avantit.pt/en/newsletter/microsoft-graph-toolkit-retires-graph-sdk-vs-pnpjs/ Source: AvantIT — https://www.avantit.pt (Microsoft Partner, Matosinhos, Portugal) --- [All editions](https://www.avantit.pt/en/newsletter/) AvantIT Insider · Edition 1 # Microsoft Graph Toolkit Retires in 8 Days. Then What? ![Arsénio Ferraz] Arsénio Ferraz 2026-08-25 6 min ![AvantIT Insider cover: Microsoft Graph Toolkit fully retires on August 28, SPFx solution support ends, with mgt-person and mgt-file-list component cards next to a calendar marked August 28] On August 28, a component library many SharePoint teams quietly rely on for people pickers, file browsers and agenda widgets stops being supported. Nine days from today. In the same week, a critical authentication bypass in on-premises SharePoint went from proof-of-concept to active exploitation in under 24 hours. Two very different deadlines, one lesson for a small IT team: the roadmap does not wait for your sprint calendar. ## What shipped (and what’s going away) CVE-2026-55040, actively exploited. Microsoft patched this authentication bypass in on-premises SharePoint Server (Subscription Edition, 2019, and 2016) during July’s Patch Tuesday. Rapid7 published the technical writeup and a proof-of-concept on August 11; attackers were hitting honeypots with it within a day. The flaw lets an unauthenticated attacker forge a JSON Web Token and impersonate any user, including an admin. A second, chained vulnerability (CVE-2026-63520) was patched in August. This is not SharePoint Online: it only affects on-premises farms. For a PME, that means anyone still running Server 2016 or 2019, which reached end of support on July 14, 2026, is now carrying two problems at once: an unsupported platform and an actively exploited hole in it. Over 8,500 SharePoint servers are still publicly exposed, according to Shadowserver. If you have anything on-prem, check the patch level today, not this sprint. Exchange Online: EWS is on a clock. Microsoft confirmed this week that Exchange Web Services (EWS) will be disabled in phases starting October 2026, with a complete shutdown in 2027. This applies to Exchange Online only, not on-premises Exchange Server. EWS is nearly 20 years old, and Microsoft Graph now covers almost every scenario it supported. What this means for a PME: if you have a CRM connector, a calendar sync tool, or an old custom integration that authenticates against EWS, someone needs to confirm it has a Graph-based path before the disablement window opens. Microsoft Graph Toolkit, full retirement August 28. MGT entered deprecation in September 2025 and reaches full retirement in eight days. If any SPFx web part or web app in your tenant still uses MGT components ( mgt-person , mgt-file-list , mgt-agenda ), they will stop receiving fixes and, eventually, stop rendering correctly as Graph API changes land. This is the trigger for this edition’s “in focus” section, because MGT’s disappearance forces a decision every SPFx developer eventually has to make anyway. ## In focus: Microsoft Graph SDK vs PnPjs, when to use each The situation. Every SPFx solution that touches people, files, or mail needs to call Microsoft Graph. With MGT gone, you have two real options left: call the Microsoft Graph SDK directly, or go through PnPjs ( @pnp/sp and @pnp/graph ), the community library maintained by the PnP initiative. The options. - Microsoft Graph SDK ( @microsoft/microsoft-graph-client or the newer typed SDKs): a thin, official wrapper around raw Graph HTTP calls. No SharePoint REST support, no batching helpers of its own. - PnPjs : a fluent, typed library that wraps both the SharePoint REST API and a large slice of Microsoft Graph, with built-in batching and caching, purpose-built for the SPFx context. The criteria. Choose the raw Graph SDK when your code lives outside SPFx, for example an Azure Function, a Copilot Studio custom connector, or a background agent, where you want the fewest dependencies and direct access to the newest Graph beta endpoints the moment they ship. Choose PnPjs when your solution runs inside SPFx and needs to mix SharePoint list operations with Graph calls (people, groups, files) in the same web part; the fluent syntax and automatic SPFx context setup cut a real amount of boilerplate. The hidden cost. PnPjs versioning tracks SPFx and Node.js versions closely: version 2 for on-premises 2016/2019, version 3 for older SPFx releases, version 4 for anything on SPFx 1.18 and later with Node 18+. Teams that upgrade SPFx during a client engagement and forget to bump PnPjs in lockstep end up debugging authentication errors that have nothing to do with authentication. It is a small thing that costs a full afternoon almost every time. The recommendation. For anything living inside an SPFx web part, we default to PnPjs; it removes far more boilerplate than it adds in complexity. For standalone services and AI agents outside the SPFx runtime, we go straight to the Graph SDK, because there is no SPFx context to wrap around anyway. We keep a small internal wrapper layer either way, so a future retirement announcement (there will be another one) touches one file, not forty web parts. A real example. On a recent SPFx project for a European logistics client, three web parts still used MGT’s person picker and file list components. Migrating them to PnPjs took under a day per web part once the pattern was set, and it removed a dependency the client’s security review had already flagged as “unclear ownership.” The lesson generalised faster than expected: unclear dependency ownership is usually the real cost of a retirement, not the migration itself. ## Do this week - Search your tenant’s SPFx solutions and any custom web apps for @microsoft/mgt , mgt-person , mgt-file-list , or similar tags. If you find any, plan the PnPjs or Graph SDK swap before August 28. - Grep your integrations and CRM connectors for anything calling Exchange Web Services. If it exists, confirm there is a Graph-based replacement before October. - If you run SharePoint on-premises anywhere, even a legacy dev or test farm, check the patch level against July and August 2026 cumulative updates today. If your tenant needs a second pair of eyes on any of this, reach out or take a look at [avantit.pt](https://www.avantit.pt/). This edition was first published in the [AvantIT Insider newsletter on LinkedIn](https://www.linkedin.com/pulse/microsoft-graph-toolkit-retires-8-days-what-ars%C3%A9nio-ferraz-yn0ce/). Comments and discussion happen there. Share: [Subscribe on LinkedIn](https://www.linkedin.com/pulse/microsoft-graph-toolkit-retires-8-days-what-ars%C3%A9nio-ferraz-yn0ce/) ## Other editions [Edition 2 The Premium Connector Bill Nobody Sees Coming A flow runs for months on standard connectors. Someone adds one SQL Server action, and every employee who runs it suddenly needs a premium license. Nobody flags it until the invoice shows up.](https://www.avantit.pt/en/newsletter/premium-connector-bill-nobody-sees-coming/) [See all editions](https://www.avantit.pt/en/newsletter/) ### Get the next edition by email One edition a week on Microsoft 365, SharePoint, Power Platform and AI applied to SMEs. Subscribe You can unsubscribe at any time using the link in the footer of every email. ### Does this apply to your tenant? Talk to us and we will go through your specific case, no commitment. ### Send us a message Fill out the form below and we will get back to you shortly. Name Email Company Phone Role ( optional ) Select Executive / Board IT / Technology Finance Operations Human Resources Marketing / Sales Other Company size ( optional ) Select 1-5 employees 5-25 employees 25-50 employees 50-100 employees 100-500 employees 500-1000 employees 1000+ employees Service of Interest Select a service Software Development SharePoint Intranets Power Platform Data & AI Consulting Support Message I would like to occasionally receive AvantIT content about Microsoft 365, Power Platform and automation. We use your details only to answer this enquiry. [Privacy Policy](https://www.avantit.pt/en/privacy/) Send Message