Microsoft Graph publishes every limit we track. The one that bites is four concurrent requests per mailbox.
Microsoft Graph allows 10,000 requests per 10 minutes and four concurrent requests per app per mailbox, batches of 20, and change notifications whose subscriptions expire in under seven days. An Australian tenant’s mailbox content is stored at rest in Australia. Every fact on this page is Microsoft’s own documentation, fetched 3 September 2026.
What Microsoft 365 publishes about its API
- Documentation
- Yes — learn.microsoft.com/graph is fully public, with v1.0 for production and a beta endpoint Microsoft says not to use in production apps. Microsoft Graph versioning and support, fetched 3 September 2026.
- Authentication
- OAuth 2.0 through the Microsoft identity platform (Entra ID), with MSAL libraries for .NET, JavaScript, Android and iOS. Two modes: delegated permissions act as a signed-in user; application permissions run without one, for daemons and automation. Permissions not pre-authorised by an administrator need admin consent. Microsoft Graph auth concepts, fetched 3 September 2026.
- Token lifetimes
- Access tokens get a random lifetime between 60 and 90 minutes, 75 on average. Refresh tokens expire after 90 days of inactivity and are otherwise valid until revoked. ID tokens last one hour. Microsoft identity platform token lifetimes, fetched 3 September 2026.
- Rate limits
- 130,000 requests per 10 seconds per app across all tenants. Outlook adds 10,000 requests per 10 minutes, 4 concurrent requests and 150 MB of uploads per 5 minutes, each per app per mailbox. Teams: 20 GETs a second on channel messages, 50 POSTs, per app per tenant. Excel: 1,500 requests per 10 seconds per app per tenant. Microsoft Graph throttling limits, fetched 3 September 2026.
- When you exceed one
- HTTP 429 with a Retry-After header in seconds, plus x-ms-throttle-scope and x-ms-throttle-information naming what you hit. Microsoft says to honour Retry-After because usage keeps being logged while you are throttled, and to use exponential backoff if the header is absent. Microsoft Graph throttling guidance, fetched 3 September 2026.
- Pagination
- Server-driven. Follow @odata.nextLink until it stops appearing; $top requests a page size but each API sets its own default and maximum — /users returns 100 by default. Custom headers such as ConsistencyLevel are not carried into subsequent pages automatically. Microsoft Graph paging, fetched 3 September 2026.
- Webhooks
- Yes — change notifications, on mail, calendar, contacts, drive items, SharePoint lists, users, groups and Teams messages. Basic notifications carry only the resource id; rich notifications carry the data. Subscriptions expire: under 7 days for Outlook (under 1 day with resource data), under 30 days for driveItems, 3 days for Teams messages, and the minimum is 45 minutes. Microsoft Graph subscription resource, fetched 3 September 2026.
- Event verification
- Two steps. At subscription time Graph POSTs a validationToken and your endpoint must echo it back as text/plain with HTTP 200 within 10 seconds. On every notification you compare the clientState property against the secret you set on the subscription. There is no HMAC over the payload. Microsoft Graph webhook delivery, fetched 3 September 2026.
- Retry behaviour
- Respond 2xx within 3 seconds or the notification is retried on exponential backoff for up to 4 hours, with the timeout extended to 10 seconds on retries. Microsoft recommends returning 202 and queueing. A separate lifecycle notification of type "missed" tells you when notifications were dropped, and the documented recovery is a full resync with delta query. Microsoft Graph lifecycle notifications, fetched 3 September 2026.
- Bulk operations
- JSON batching via $batch, limited to 20 individual requests. Each request inside is throttled on its own and can fail with 429 while the batch itself returns 200. dependsOn sequences requests, and a dependent request fails with 424 if its parent does. Outlook receives at most four requests from a batch at a time. Microsoft Graph JSON batching, fetched 3 September 2026.
- Test environment
- Graph Explorer runs read-only queries against a sample tenant without signing in, and against your real tenant if you do — Microsoft warns that write requests there affect real data. The Microsoft 365 Developer Program E5 sandbox — 25 licences, renewed on developer activity — is now limited to Visual Studio Professional or Enterprise subscribers, ISV Success and eligible partner-program members, and Premier or Unified Support customers. Microsoft 365 Developer Program FAQ, fetched 3 September 2026.
- Data location
- Australia is a Local Region Geography. A tenant provisioned in Australia has Exchange Online mailbox content — email bodies, calendar entries and attachments — stored at rest only within Australia. The default geography is set by the country chosen at tenant creation and cannot be changed afterwards. Microsoft 365 data residency overview, fetched 3 September 2026.
- Cost of API access
- No charge for Graph itself beyond the user licences. As of 25 August 2025 the Teams APIs are no longer metered, and the only metered API listed is SharePoint and OneDrive assignSensitivityLabel at US$0.00185 per call, which requires an Azure subscription attached to the app. Microsoft Graph metered APIs, fetched 3 September 2026.
Every line above is the vendor’s own documentation, fetched 3 September 2026, linked so you can check it yourself. All thirteen fields are published, which is rarer than it should be. The full capability register puts this beside the other systems.
What the Microsoft Graph API does and does not allow
Outlook, Teams, SharePoint and OneDrive behind one API — Microsoft Graph. The inbox and calendar of most Australian trade offices, and the system an intake or triage automation reads first.
Everything in the strip above is Microsoft’s own published documentation, fetched 3 September 2026 and linked to the page it came from. Microsoft publishes all thirteen fields we track — the only system in our register that does. That does not make it simple. Graph is one gateway in front of a dozen services — Exchange, SharePoint, Teams, Entra — and each one keeps its own throttling rules underneath.
We read from Microsoft 365 in production, mostly Outlook mail and calendar, which is why this page exists. What follows is what those published facts mean for a build — the constraints that change a design rather than the ones that are merely true. The same treatment for the other systems sits in the capability register, and the integration checker on the tools page answers the narrower question of whether we have built against both ends of a pairing.
Inbox triage: reading a mailbox without reading every mailbox
The most common Microsoft 365 automation we are asked for is inbox triage: watch a shared mailbox, work out what each message is — a quote request, a supplier invoice, a variation, a complaint — and put it where it belongs. The Graph mail API supports all of it: read, move, categorise, attach and send (Microsoft Graph Outlook mail overview, fetched 3 September 2026).
The design decision comes before the first call. An automation that runs without a signed-in person uses application permissions, and an application permission such as Mail.Read applies to every mailbox in the tenant by default. Exchange Online’s RBAC for Applications lets an administrator pin that grant to a management scope or admin unit — the one shared inbox, not the director’s — and Microsoft states it replaces the older Application Access Policies (Microsoft Graph, limiting mailbox access, fetched 3 September 2026).
We will not build a mail automation without that scope in place. It is not a Microsoft rule — the API works fine without it. It is the difference between an integration that reads the accounts inbox and one that could read anyone’s, and the second one should not exist on a small business tenant regardless of how well behaved the code is.
- KNDR·01Scope the app to the mailboxRBAC for Applications, before the first token. Mail.Read across the tenant is a finding in an audit, not a convenience.
- KNDR·02Push, then reconcileChange notifications for the moment something arrives, delta query on a schedule to catch what the notifications missed. Microsoft documents both and tells you to expect the gap.
- KNDR·03Stop at a folder, not a decisionThe automation moves and tags. A person still decides what a $40,000 variation means. Same boundary as the draft-bill rule on Xero.
Change notifications: they work, they expire, and they tell you when they missed something
Graph’s webhooks are called change notifications and they are genuinely good. Mail, calendar, contacts, drive items, SharePoint lists, users, groups and Teams messages all support them. Validation is a POST with a validationToken that you echo back as text/plain within 10 seconds; each notification then carries the clientState secret you set, which you compare before trusting anything (Microsoft Graph webhook delivery, fetched 3 September 2026).
Two things make them different from Xero or Stripe. First, subscriptions expire fast: under 7 days for Outlook resources, under 1 day if you want resource data in the payload, 3 days for Teams messages, under 30 days for OneDrive, and nothing shorter than 45 minutes is accepted (Microsoft Graph subscription resource, fetched 3 September 2026). Renewal is a scheduled job you own. Forget it and the integration goes quiet with no error at all.
Second, Microsoft tells you when it dropped something. Lifecycle notifications of type "missed" say that some change notifications were not delivered — because of throttling, usually — and the documented recovery is a full resync with delta query (Microsoft Graph lifecycle notifications, fetched 3 September 2026). Very few vendors write that sentence down. Delivery itself is retried on exponential backoff for up to 4 hours if you fail to answer 2xx within 3 seconds, so the correct handler returns 202 immediately and queues.
Rate limits and what breaks at scale
The published ceiling is 130,000 requests per 10 seconds per app across all tenants, and nobody on this site will approach it. The limits that bind are the Outlook ones: 10,000 requests per 10 minutes, 4 concurrent requests, and 150 MB of uploads per 5 minutes, each counted per app per mailbox (Microsoft Graph throttling limits, fetched 3 September 2026). Exceeding them on one mailbox does not affect the app’s access to another.
Four concurrent is the one you hit first, and you hit it with a for-each loop. A parallel fetch of twenty message bodies from one inbox trips MailboxConcurrency at request five. Batching does not rescue you: $batch is capped at 20 requests, each is throttled on its own and can come back 429 inside a 200 envelope, and Graph feeds Outlook at most four requests from a batch at a time anyway (Microsoft Graph JSON batching, fetched 3 September 2026). The design that works is a per-mailbox queue with a concurrency of four, full stop.
When you are throttled Graph returns 429 with a Retry-After in seconds plus x-ms-throttle-scope and x-ms-throttle-information saying which limit and why. Microsoft is explicit that honouring Retry-After is the fastest recovery, because usage keeps being logged while you are throttled — retrying early digs the hole deeper (Microsoft Graph throttling guidance, fetched 3 September 2026). Teams has its own ceilings — 20 GETs and 50 POSTs a second on channel messages per app per tenant — and Excel 1,500 requests per 10 seconds per app per tenant, so a workbook-driven report is a different budget from a mail one.
Data in Australia, tokens, and the sandbox that is no longer free for everyone
For an Australian tenant this is the best residency answer in our register. Microsoft names Australia as a Local Region Geography, the default geography is fixed by the country chosen when the tenant was created and cannot be changed afterwards, and Exchange Online mailbox content — bodies, calendar entries and attachments — is stored at rest only within Australia for a tenant provisioned here (Microsoft 365 data residency overview and Exchange Online data location, both fetched 3 September 2026). Compare GoHighLevel and Zapier, both United States only in our register.
Tokens are ordinary OAuth 2.0 through the Microsoft identity platform, with MSAL libraries doing the work. Access tokens last a random 60 to 90 minutes — 75 on average — refresh tokens expire after 90 days without use, and ID tokens last an hour (Microsoft identity platform token lifetimes, fetched 3 September 2026). The 90-day inactivity rule matters for delegated integrations on a seasonal business; application permissions sidestep it.
The test environment has changed. Graph Explorer still works without signing in, against sample data, for reads. The Microsoft 365 Developer Program E5 sandbox — 25 licences, renewed on developer activity — is now available through Visual Studio Professional or Enterprise subscriptions, the ISV Success program, eligible partner tiers or a Premier or Unified Support contract, and not otherwise (Microsoft 365 Developer Program FAQ, fetched 3 September 2026). Graph itself carries no charge beyond the user licences; since 25 August 2025 the only metered API listed is assignSensitivityLabel at US$0.00185 a call (Microsoft Graph metered APIs, fetched 3 September 2026).
What Microsoft does not publish
Nothing, on the thirteen fields we track — and it is worth being fair about how unusual that is. None of the other twelve systems in our register publishes all thirteen.
That is not the same as there being nothing left to learn. Graph’s documentation is honest about the gap between documented and observed behaviour in a way most vendors are not: it names the "missed" lifecycle event, it tells you a delta token can be revoked with a 410 Gone and that the only answer is a full resync, and it says beta APIs may break without notice and must not be used in production (Microsoft Graph delta query and versioning and support, both fetched 3 September 2026). Generally available APIs get at least 24 months’ deprecation notice.
What we would still want to measure, and have not published: how often the "missed" event actually fires on a busy shared inbox, and how long a cold delta resync of a 40,000-message mailbox really takes under the four-concurrent ceiling. Those numbers will appear here with the date and conditions when we have them. Not before.
What we have built, and what we have not measured
We read from Microsoft 365 in production — Outlook mail and calendar through Graph — as part of intake and triage builds. That is a real fact and a limited one. It says we have solved this system’s problems before; it does not say how fast, how reliably or at what volume.
Everything on this page above this line is Microsoft’s published documentation, fetched, dated and linked rather than paraphrased. Nothing here is a Kindra measurement, because our measured register is not finished, and publishing half of it dressed as all of it would make this page less useful.
On an engagement we would measure the specific things your build depends on — the mailboxes, at your volume, with your data — and hand you those numbers whether or not they suit us. Start with a Leak Check, or read how we work if you would rather know the shape of it first.
The questions people actually ask.
01We already have Power Automate. Why would we need anything else?
Often you do not, and if that is the answer we will say so. Power Automate sits on the same Graph endpoints and the same throttling rules described here, and for a linear flow inside Microsoft 365 it is the right tool and already paid for. The case for a build starts where the flow has to talk to a system Microsoft does not connect to — a Simpro build, a supplier portal, a legacy database — or where the four-concurrent-per-mailbox ceiling needs a real queue in front of it. Same logic as the Zapier versus build comparison.
02Does an automation get to read everyone’s email?
Only if it is set up carelessly, and we will not set it up that way. An application permission such as Mail.Read is tenant-wide by default in Microsoft’s own documentation. Exchange Online’s RBAC for Applications restricts the grant to specific mailboxes, and we require that scoping on every mail automation before it receives its first token. You can check the scope yourself in Exchange admin, and you own the app registration, so you can revoke it in a minute.
03What happens when Microsoft changes the API?
They will, and they are unusually clear about how. Generally available Graph APIs get at least 24 months’ deprecation notice; beta APIs can change without notice, which is why we do not build on them. What matters is that the integration is built so a change is a contained fix rather than a rebuild, and that somebody is watching the deprecation feed. You own the code either way.
Stop bending.
Start shipping.
Bring the one flow that keeps costing you a Tuesday afternoon. We map it live and tell you what we'd build, what we wouldn't, and what it costs.