Microsoft SharePoint · Rate Limits

Sharepoint Rate Limits

SharePoint Online enforces multi-layered throttling across user, tenant, application, and per-site scopes. Limits are expressed in Resource Units (RUs) for Microsoft Graph (1 RU per single-item query, 2 RUs per multi-item or write, 5 RUs for permission operations); CSOM and REST do not have a fixed RU cost but are subject to additional internal limits. On throttling, SharePoint returns 429 or 503 with a Retry-After header. Optional preview RateLimit headers (RateLimit-Limit / -Remaining / -Reset) are returned when an app reaches >=80% of its 1-minute resource-unit budget.

Sharepoint Rate Limits is the machine-readable rate-limit profile for Microsoft SharePoint on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 27 rate-limit definitions, measuring requests, GB, emails, resource_units, and requests_per_second.

The profile also includes 7 backoff/retry policies defined and response codes documented for throttled and serviceUnavailable.

Tagged areas include SharePoint, Microsoft 365, Microsoft Graph, and Rate Limiting.

27 Limits Throttle: 429
SharePointMicrosoft 365Microsoft GraphRate Limiting

Limits

User — Requests user
requests · 5-minute
3000
User — Ingress user
GB · hour
50
User — Egress user
GB · hour
100
User — Delegation Token Request user
requests · 5-minute
50
User — External Sharing Emails user
emails · hour
200
Tenant — Resource Units (5 min, 0–1,000 licenses) tenant
resource_units · 5-minute
18750
Tenant — Resource Units (5 min, 1,001–5,000 licenses) tenant
resource_units · 5-minute
37500
Tenant — Resource Units (5 min, 5,001–15,000 licenses) tenant
resource_units · 5-minute
56250
Tenant — Resource Units (5 min, 15,001–50,000 licenses) tenant
resource_units · 5-minute
75000
Tenant — Resource Units (5 min, 50,000+ licenses) tenant
resource_units · 5-minute
93750
Tenant — Assign Sensitivity Label tenant
requests · 5-minute
100
Tenant — PeopleManager APIs (5 min, 0–1,000 licenses) tenant
requests · 5-minute
3000
Tenant — PeopleManager APIs (5 min, 50,000+ licenses) tenant
requests · 5-minute
15000
Per App per Tenant — Resource Units (24 H, 0–1,000 licenses) tenant/app
resource_units · day
1200000
Per App per Tenant — Resource Units (24 H, 50,000+ licenses) tenant/app
resource_units · day
6000000
Per App per Tenant — Resource Units (1 min, 0–1,000 licenses) tenant/app
resource_units · minute
1250
Per App per Tenant — Resource Units (1 min, 50,000+ licenses) tenant/app
resource_units · minute
6250
Per App per Tenant — Ingress tenant/app
GB · hour
400
Per App per Tenant — Egress tenant/app
GB · hour
400
Per App per Tenant — Specific Sharing APIs tenant/app
requests · 5-minute
300
SharePoint Embedded Containers — Resource Units container
resource_units · minute
3000
Per Site — Anonymous Link site
requests · 5-minute
3000
Per Site — Anonymous Egress (Download) site
GB · 2-hour
100
Per Site — External Sharing Emails site
emails · hour
200
Search — App-only with Sites.Read.All app
requests_per_second · second
25
Search — Delegated user user
requests_per_second · second
10
People Search — Org-wide tenant
requests_per_second · second
25

Policies

Resource-unit cost model
Microsoft Graph requests are priced in Resource Units (1 = single item / delta with token / file download, 2 = multi-item / write, 5 = permission operations). CSOM and REST have no fixed RU cost and are typically more expensive per request — prefer Microsoft Graph.
Honor Retry-After
On 429 or 503, honor the Retry-After header. Throttled requests still count toward usage limits, so aggressive retry loops worsen throttling.
RateLimit headers (preview)
At >=80% of the app 1-minute resource-unit limit, SharePoint returns RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset (IETF draft-03). Use them to throttle pre-emptively.
Decorate traffic
Send User-Agent in the form ISV|CompanyName|AppName/Version (or NONISV|... for enterprise apps) and register an Entra (Azure AD) AppID to receive priority over undecorated traffic.
Multi-Geo
Each geo has its own usage measurement; license-bound limits use the total tenant license count across all geos.
Peak vs off-peak
Throttling is more aggressive during regional peak hours; bulk scanning workloads should run during off-peak windows where possible.
Block escalation
Sustained excessive traffic can result in the app or tenant being blocked (continuous 503); Microsoft notifies the customer via Office 365 Message Center and requires remediation before lifting the block.

Sources