Entra ID provisioning API rate limit hit mid-license-assignment: agent failed with error 429 too many requests

TL;DR

Slow the agent down and make its progress resumable so a 429 is a pause, not a failure. Honour the retry timing the Entra ID provisioning API returns, cut parallel calls for the step, checkpoint completed hires so a resumed run skips them, and spread bulk cohorts over a longer window. Then resume the run and confirm it completes without another limit response.

Entra ID provisioning API rate limit hit: agent failed with error 429 too many requests

Use this when

• The agent run fails partway through assign Microsoft 365 licenses with a 429 response from the Entra ID provisioning API.
• The run processes hires in parallel or in rapid sequence with no pacing.
• Manual single calls to the same API succeed at the same time.

Not for this skill when

• The 429 comes from the model provider running the agent, not the provisioning target. Pace the model calls instead.
• The tenant hit a hard monthly quota. That requires a plan or quota change, not pacing.

Steps

1. Open the run log at the 429 and record how many calls the agent made in the minute before it, how many parallel workers or hires were active, and whether the Entra ID provisioning API response included a retry delay header or body value. Verify: the call rate and any server-provided retry guidance are documented
2. Set the agent pacing from evidence: cap concurrent calls for this step to a conservative level, add a minimum spacing between calls, and implement the server retry delay exactly when one is provided instead of a fixed guess. Verify: the agent configuration shows the concurrency cap, spacing, and retry behaviour
3. Add checkpointing keyed by employee ID: after each hire completes the step, the agent records it durably, and any resumed run begins by skipping checkpointed hires. Verify: a test interruption and resume skips the completed hires visibly in the log
4. Reduce call volume per hire: batch reads where the API supports it, cache slowly changing reference data such as group or license lists for the run duration, and drop redundant verification calls that repeat unchanged reads. Verify: the calls per hire count drops measurably on a sample run
5. Resume the interrupted run for the remaining hires and monitor the Entra ID provisioning API responses through completion, confirming no further 429 responses appear and every hire reaches the intended state in Entra ID. Verify: the run completes with zero new rate limit responses
6. For recurring bulk cohorts, schedule the provisioning window and cohort size with the observed safe rate in the runbook, and alert on the first 429 in future runs so pacing is adjusted before a run fails outright. Verify: the runbook states the safe rate and the alert exists

Why it happens

Rate limits protect the Entra ID provisioning API for all tenants, and agents hit them easily because a workflow that feels like one step to a human is dozens of rapid calls when multiplied by parallel hires and chatty verification reads. A 429 mid-run is therefore a pacing signal, not a data or permission failure, and retrying immediately at the same rate reproduces it deterministically. Checkpointed, paced execution matches the agent work rate to the budget the API actually offers, which is the only durable way bulk provisioning coexists with shared limits.

Variants and edge cases

Limit is per-minute but the cohort is huge

Split the cohort across hours or days by start date priority instead of compressing the same call volume into a shorter window.

One noisy step consumes the budget

Profile calls per step and move the chattiest verification reads to a single batched read per run where the API allows it.

Limits differ between target tenants

Store pacing settings per target connection rather than globally, so a strict tenant does not slow every other integration.

Compatibility: Applies to agent provisioning workflows calling the Entra ID provisioning API at volume. Requires agent configuration and run monitoring access.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3lU8ZAZHMzQImoaJk-2dKQ