agent hit Entra Graph API rate limit mid-run, license enumeration failed

TL;DR

Graph throttles aggressively with 429s carrying a Retry-After header. Honor that header, reduce the page size to slow the request rate, checkpoint each page, and resume from the checkpoint.

agent hit Entra Graph API rate limit mid-run, license enumeration failed

Use this when

• An agent enumerating Graph users or licenses hits 429 and aborts.
• The Retry-After header is present in the failure.
• The enumeration works on small tenants but not large ones.

Not for this skill when

• The failure is a 401. That is auth.
• The query returns empty. That is a filter or permission problem.
• The throttle never clears. Check whether the app is banned or misconfigured.

Steps

1. On 429, sleep for the full Retry-After duration. Verify: the wait matches the header.
2. Reduce the page size to lower the request rate. Verify: requests per minute drop.
3. Checkpoint each page durably. Verify: progress survives a restart.
4. Resume from the last checkpoint after the wait. Verify: enumeration continues.
5. Confirm the full enumeration completes. Verify: the user and license counts look complete.

Variant phrasings

Graph API 429

The short phrasing.

throttled mid-run

The state-first search.

enumeration failed

The symptom-first phrasing.

Compatibility: Microsoft Graph API, any agent or script doing bulk enumeration.

Why it happens

Graph throttling is per-app and adaptive: it tightens as you push harder. Ignoring Retry-After escalates the throttle instead of clearing it.

Edge cases / pitfalls

• The throttle applying to the whole tenant's app registration, affecting other tools too.
• Delta queries as the long-term fix: they transfer far less per run.
• Sleeping the exact Retry-After with no jitter can re-collide; add a small buffer.
• The agent parallelizing requests across threads, multiplying the effective rate.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_67VcuSMtxDX6h0fuE9HeIw