title: What's the correct Microsoft Graph API endpoint for promoting a subdomain to root in Azure AD? It exists in Azure AD Graph API, but that's deprecated
body: <p><strong>Background:</strong><br>
  I want to add a subdomain to Azure AD so that users can have it as a UPN suffix. The parent domain is federated, but I don't want the child domain to be federated. The child domain inherits the authentication type of the parent, unless you use this one Azure Active Directory Graph API method to promote the subdomain to root. Then it can have it's own authentication type and settings applied.</p>
  <p><strong>Problem:</strong><br>
  What's the correct Microsoft Graph API endpoint for promoting a subdomain to root? It exists in Azure AD Graph API, but that's deprecated:
  <a href="https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-verify-custom-subdomain" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-verify-custom-subdomain</a></p>
  <blockquote>
  <p><strong>Use Microsoft Graph API to make this a root domain</strong>
  <br>
  Use the following command to promote the subdomain:
  <br>
  <code>POST https://graph.windows.net/{tenant_id}/domains/child.mydomain.com/promote?api-version=1.6</code></p>
  </blockquote>
  <p>If I fill in {tenant_id} and fill in the subdomain I want to promote into Microsoft Graph Explorer, it fails with this:</p>
  <p><code>&quot;Your access token has expired. Please renew it before submitting the request.&quot;</code></p>
  <p>I think that's because it's a Azure Active Directory Graph API call (graph.windows.net) instead of a Microsoft Graph API call. So the tokens have different audiences.</p>
  <p>It sounds like the conversion process is this:</p>
  <p><code>https://graph.windows.net/{tenant_id}/{resource}?{version}</code>
  <br>
  <code>https://graph.microsoft.com/{version}/{resource}</code></p>
  <p>So I tried to run it like this:<br>
  <code>https://graph.microsoft.com/v1.0/domains/child.mydomain.com/promote</code></p>
  <p>But that fails with:<br>
  <code>BadRequest</code><br>
  <code>Resource not found for the segment 'promote'.</code></p>
  <p>I did try to create an Application Registration in Azure and give it permission to Azure Active Directory Graph, but it's locked. It sounds like Microsoft is locking out new registrations to avoid people creating new Application that target it. It displays this warning message:<br>
  <code>Azure Active Directory Graph will be deprecated in June 2022. We recommend using Microsoft Graph APIs for your application. If you are currently using Azure Active Directory Graph, please migrate to Microsoft Graph.</code></p>