Microsoft SharePoint · Rate Limits

Sharepoint Rate Limits

SharePoint Online enforces multi-layered throttling across user, tenant, application, and per-site scopes. Limits are expressed in Resource Units (RUs) for Microsoft Graph (1 RU per single-item query, 2 RUs per multi-item or write, 5 RUs for permission operations); CSOM and REST do not have a fixed RU cost but are subject to additional internal limits. On throttling, SharePoint returns 429 or 503 with a Retry-After header. Optional preview RateLimit headers (RateLimit-Limit / -Remaining / -Reset) are returned when an app reaches >=80% of its 1-minute resource-unit budget.

Sharepoint Rate Limits is the machine-readable rate-limit profile for Microsoft SharePoint on the APIs.io network, in the API Commons Rate Limits shape.

It captures 27 rate-limit definitions, measuring requests, GB, emails, resource_units, and requests_per_second.

Limit state is signalled in the retryAfter, limit, remaining, and reset response headers, and an exhausted limit returns HTTP 429.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes 7 backoff/retry policies defined and response codes documented for throttled and serviceUnavailable.

Tagged areas include SharePoint, Microsoft 365, Microsoft Graph, and Rate Limiting.

27 Limits Exhausted: HTTP 429 retryAfterlimitremainingreset
Method: generated, dated 2026-05-05.
Written by API Evangelist on 2026-05-05 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
SharePointMicrosoft 365Microsoft GraphRate Limiting

Limits

User — Requests user
requests · 5-minute
3000
User — Ingress user
GB · hour
50
User — Egress user
GB · hour
100
User — Delegation Token Request user
requests · 5-minute
50
User — External Sharing Emails user
emails · hour
200
Tenant — Resource Units (5 min, 0–1,000 licenses) tenant
resource_units · 5-minute
18750
Tenant — Resource Units (5 min, 1,001–5,000 licenses) tenant
resource_units · 5-minute
37500
Tenant — Resource Units (5 min, 5,001–15,000 licenses) tenant
resource_units · 5-minute
56250
Tenant — Resource Units (5 min, 15,001–50,000 licenses) tenant
resource_units · 5-minute
75000
Tenant — Resource Units (5 min, 50,000+ licenses) tenant
resource_units · 5-minute
93750
Tenant — Assign Sensitivity Label tenant
requests · 5-minute
100
Tenant — PeopleManager APIs (5 min, 0–1,000 licenses) tenant
requests · 5-minute
3000
Tenant — PeopleManager APIs (5 min, 50,000+ licenses) tenant
requests · 5-minute
15000
Per App per Tenant — Resource Units (24 H, 0–1,000 licenses) tenant/app
resource_units · day
1200000
Per App per Tenant — Resource Units (24 H, 50,000+ licenses) tenant/app
resource_units · day
6000000
Per App per Tenant — Resource Units (1 min, 0–1,000 licenses) tenant/app
resource_units · minute
1250
Per App per Tenant — Resource Units (1 min, 50,000+ licenses) tenant/app
resource_units · minute
6250
Per App per Tenant — Ingress tenant/app
GB · hour
400
Per App per Tenant — Egress tenant/app
GB · hour
400
Per App per Tenant — Specific Sharing APIs tenant/app
requests · 5-minute
300
SharePoint Embedded Containers — Resource Units container
resource_units · minute
3000
Per Site — Anonymous Link site
requests · 5-minute
3000
Per Site — Anonymous Egress (Download) site
GB · 2-hour
100
Per Site — External Sharing Emails site
emails · hour
200
Search — App-only with Sites.Read.All app
requests_per_second · second
25
Search — Delegated user user
requests_per_second · second
10
People Search — Org-wide tenant
requests_per_second · second
25

Policies

Resource-unit cost model
Microsoft Graph requests are priced in Resource Units (1 = single item / delta with token / file download, 2 = multi-item / write, 5 = permission operations). CSOM and REST have no fixed RU cost and are typically more expensive per request — prefer Microsoft Graph.
Honor Retry-After
On 429 or 503, honor the Retry-After header. Throttled requests still count toward usage limits, so aggressive retry loops worsen throttling.
RateLimit headers (preview)
At >=80% of the app 1-minute resource-unit limit, SharePoint returns RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset (IETF draft-03). Use them to throttle pre-emptively.
Decorate traffic
Send User-Agent in the form ISV|CompanyName|AppName/Version (or NONISV|... for enterprise apps) and register an Entra (Azure AD) AppID to receive priority over undecorated traffic.
Multi-Geo
Each geo has its own usage measurement; license-bound limits use the total tenant license count across all geos.
Peak vs off-peak
Throttling is more aggressive during regional peak hours; bulk scanning workloads should run during off-peak windows where possible.
Block escalation
Sustained excessive traffic can result in the app or tenant being blocked (continuous 503); Microsoft notifies the customer via Office 365 Message Center and requires remediation before lifting the block.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/sharepoint-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.