specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Microsoft Intune
providerId: microsoft-intune
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Rate Limiting
  - Endpoint Management
  - Intune
  - Microsoft Graph
  - Microsoft
description: Microsoft Intune is administered via the Microsoft Graph deviceManagement endpoints; throttling
  is governed by the underlying Microsoft Graph Identity & Access (directory) service throttling and the
  global Graph ceiling, plus device-check-in fan-out limits enforced by the Intune service. Microsoft
  does not publish per-second numbers for the deviceManagement / device-check-in endpoints; clients should
  treat fair-use behaviour and honour Retry-After.
sources:
  - https://learn.microsoft.com/en-us/graph/throttling
  - https://learn.microsoft.com/en-us/graph/throttling-limits
  - https://learn.microsoft.com/en-us/intune/intune-service/developer/intune-graph-apis
notes: Microsoft does not publish numeric per-second throttling limits for the Intune-specific Microsoft
  Graph deviceManagement endpoints. Limits below are inherited from Graph Identity & Access plus the global
  Graph ceiling.
headers:
  retryAfter: Retry-After
  requestId: request-id
  throttleScope: x-ms-throttle-scope
  throttleLimit: x-ms-throttle-limit-percentage
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Microsoft Graph global ceiling
    scope: application
    metric: requests_per_10_seconds
    limit: 130000
    timeFrame: second
  - name: Identity & Access (read) per app/tenant
    scope: app/tenant
    metric: resource_units_per_10_seconds
    limit: see Graph throttling-limits — varies by tenant size (3500 / 5000 / 8000 RU)
  - name: Identity & Access (write) per app/tenant
    scope: app/tenant
    metric: requests_per_2m30s
    limit: 3000
    timeFrame: second
  - name: Intune deviceManagement endpoints
    scope: app/tenant
    metric: varies
    limit: see Microsoft Graph throttling guidance — no Intune-specific numbers published
  - name: Device check-in fan-out
    scope: tenant
    metric: varies
    limit: bounded by service capacity; high-volume bulk actions are queued
policies:
  - name: Backoff Strategy
    description: Honour Retry-After on 429 / 503; the Microsoft Graph SDK handlers do this automatically.
  - name: Use $batch for bulk
    description: Combine related read calls in $batch envelopes; each request is throttled individually
      but network overhead is reduced.
  - name: Use change notifications
    description: Subscribe to Graph change notifications for device / compliance changes rather than polling.
  - name: Plan write operations
    description: Bulk policy assignments and device actions are queued and may take time to converge across
      the tenant; do not retry-storm.
  - name: Microsoft Graph Data Connect for analytics
    description: For tenant-wide reporting, use Data Connect to bypass REST throttling.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com