diff --git a/ms-graph-api/CHANGELOG.md b/ms-graph-api/CHANGELOG.md
index 5374f2d..e397277 100644
--- a/ms-graph-api/CHANGELOG.md
+++ b/ms-graph-api/CHANGELOG.md
@@ -9,15 +9,17 @@ and this project adheres to the
 ## Unreleased
 
 
-## 1.0.0.0
 
-MSGraphAPI.ChangeNotifications.Subscription
+
+## 0.7.0.0
+
+MSGraphAPI.ChangeNotifications.Subscription:
+- add createSubscription
 
 *Breaking changes*
 
 Moved the Network/* module hierarchy to the `ms-auth` package shared with `ms-azure-api`.
 
-
 ## 0.6.0.0
 
 MSGraphAPI.Users.Group :
diff --git a/ms-graph-api/ms-graph-api.cabal b/ms-graph-api/ms-graph-api.cabal
index 05e151c..1e60e77 100644
--- a/ms-graph-api/ms-graph-api.cabal
+++ b/ms-graph-api/ms-graph-api.cabal
@@ -13,7 +13,7 @@ build-type:          Simple
 extra-source-files:  README.md
                      CHANGELOG.md
 cabal-version:       >=1.10
-tested-with:         GHC == 9.2.7
+tested-with:         GHC == 9.2.8
 
 library
   default-language:    Haskell2010
diff --git a/ms-graph-api/src/MSGraphAPI/ChangeNotifications/Subscription.hs b/ms-graph-api/src/MSGraphAPI/ChangeNotifications/Subscription.hs
index b332bf4..886dcc8 100644
--- a/ms-graph-api/src/MSGraphAPI/ChangeNotifications/Subscription.hs
+++ b/ms-graph-api/src/MSGraphAPI/ChangeNotifications/Subscription.hs
@@ -4,7 +4,7 @@ import Data.List.NonEmpty (NonEmpty)
 import GHC.Generics (Generic(..))
 
 -- aeson
-import qualified Data.Aeson as A (ToJSON(..), FromJSON(..), eitherDecode, genericParseJSON, defaultOptions, Options(..), withObject, withText, (.:), (.:?), object, (.=))
+import qualified Data.Aeson as A (ToJSON(..), FromJSON(..), eitherDecode, genericParseJSON, genericToEncoding, defaultOptions, Options(..), withObject, withText, (.:), (.:?), object, (.=))
 import qualified Data.Aeson.Encoding as A (text)
 -- hoauth
 import Network.OAuth.OAuth2.Internal (AccessToken(..))
@@ -18,6 +18,10 @@ import Data.Time (LocalTime)
 import qualified MSGraphAPI.Internal.Common as MSG (Collection(..), get, post, aesonOptions)
 import MSGraphAPI.Files.DriveItem (DriveItem)
 
+-- | Creating a subscription requires read scope to the resource. For example, to get change notifications on messages, your app needs the Mail.Read permission.
+createSubscription :: (A.FromJSON b) => Subscription -> AccessToken -> Req b
+createSubscription = MSG.post ["subscriptions"] mempty
+
 -- | A subscription allows a client app to receive change notifications about changes to data in Microsoft Graph.
 --
 -- https://learn.microsoft.com/en-us/graph/api/resources/subscription?view=graph-rest-1.0
@@ -28,10 +32,28 @@ data Subscription = Subscription {
   , cnsExpirationDateTime :: LocalTime
   , cnsNotificationUrl :: Text -- ^ The URL of the endpoint that will receive the change notifications. This URL must make use of the HTTPS protocol. Any query string parameter included in the notificationUrl property will be included in the HTTP POST request when Microsoft Graph sends the change notifications.
   , cnsResource :: Text -- ^ Specifies the resource that will be monitored for changes. Do not include the base URL (https://graph.microsoft.com/v1.0/)
+  , cnsLatestSupportedTLSVersion :: LatestTLSVer
                    } deriving (Eq, Show, Generic)
 instance A.FromJSON Subscription where
   parseJSON = A.genericParseJSON (MSG.aesonOptions "cns")
+instance A.ToJSON Subscription where
+  toEncoding = A.genericToEncoding (MSG.aesonOptions "cns")
 
+data LatestTLSVer = LTV10 | LTV11 | LTV12 | LTV13 deriving (Eq, Show, Generic)
+instance A.FromJSON LatestTLSVer where
+  parseJSON = A.withText "LatestTLSVer" $ \t ->
+    case t of
+      "v1_0" -> pure LTV10
+      "v1_1" -> pure LTV11
+      "v1_2" -> pure LTV12
+      "v1_3" -> pure LTV13
+      x -> fail $ unwords ["LatestTLSVer : unexpected value:", unpack x]
+instance A.ToJSON LatestTLSVer where
+  toEncoding = \case
+    LTV10 -> A.text "v1_0"
+    LTV11 -> A.text "v1_1"
+    LTV12 -> A.text "v1_2"
+    LTV13 -> A.text "v1_3"
 
 data ChangeType = CTCreated
                 | CTUpdated