## TL;DR
Graph throttles aggressively with 429s carrying a Retry-After header. Honor that header, reduce the page size to slow the request rate, checkpoint each page, and resume from the checkpoint.

```text
agent hit Entra Graph API rate limit mid-run, license enumeration failed
```

## Use this when
- An agent enumerating Graph users or licenses hits 429 and aborts.
- The Retry-After header is present in the failure.
- The enumeration works on small tenants but not large ones.

## Not for this skill when
- The failure is a 401. That is auth.
- The query returns empty. That is a filter or permission problem.
- The throttle never clears. Check whether the app is banned or misconfigured.

## Steps
1. On 429, sleep for the full Retry-After duration. Verify: the wait matches the header.
2. Reduce the page size to lower the request rate. Verify: requests per minute drop.
3. Checkpoint each page durably. Verify: progress survives a restart.
4. Resume from the last checkpoint after the wait. Verify: enumeration continues.
5. Confirm the full enumeration completes. Verify: the user and license counts look complete.

## Variant phrasings
### Graph API 429
The short phrasing.
### throttled mid-run
The state-first search.
### enumeration failed
The symptom-first phrasing.

Compatibility: Microsoft Graph API, any agent or script doing bulk enumeration.

## Why it happens
Graph throttling is per-app and adaptive: it tightens as you push harder. Ignoring Retry-After escalates the throttle instead of clearing it.

## Edge cases / pitfalls
- The throttle applying to the whole tenant's app registration, affecting other tools too.
- Delta queries as the long-term fix: they transfer far less per run.
- Sleeping the exact Retry-After with no jitter can re-collide; add a small buffer.
- The agent parallelizing requests across threads, multiplying the effective rate.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_67VcuSMtxDX6h0fuE9HeIw