Clarification on OAuth app notifications and throttling limits in Azure DevOps

Question

Hello Team,

We recently received an automated notification from Azure DevOps stating that requests made by an OAuth app are being delayed due to high resource consumption.

In our setup, we have created an OAuth app and added it to our Azure DevOps organization as a service principal user with Project Collection Administrator (PCA) permissions. This app is used for automation and integration tasks within our DevOps environment. Since this OAuth-based user does not have an associated email address, the throttling alert notification was delivered to all Project Collection Administrators.

We would like to request clarification on the following points:

1. Is there a way to associate an email address with an OAuth app (service principal) that has been added as a user in Azure DevOps? If an email is associated, will future notifications (such as throttling or resource usage alerts) be sent to that address instead of to the administrators?
2. Is it possible to increase or extend the throttling/resource consumption limit for OAuth apps either through a support request or higher licensing tier?
3. Is there any option to disable, suppress, or redirect these resource consumption notifications to a specific mailbox or distribution group instead of automatically sending them to all Project Collection Administrators?

We would appreciate your guidance on the best practices for managing OAuth app identities in Azure DevOps — specifically regarding notification routing, throttling limits, and email configuration.

Thank you,
Gopalakrishnan G

Answer 1

Hi @Gopalakrishnan G,

Thanks for reaching out to Microsoft Q&A.

Your OAuth app is acting like a service user in Azure DevOps but doesn’t have an email address linked to it. Because of this, when Azure DevOps detects that this app is consuming a lot of resources and slows down requests, it doesn’t have a direct email to send alerts to. Instead, these notifications are sent to all your Project Collection Administrators, which can feel overwhelming.

Unfortunately, there is no direct way to associate an email address with OAuth apps (service principals). The notifications for events, like throttling alerts, will typically go to the Project Collection Administrators (PCA) due to the lack of an email address linked with the OAuth app. If you want personalized alerts, consider ensuring that key individuals within your admin team regularly check notifications.

• Increasing or extending throttling/resource consumption limits is not straightforward. Azure DevOps has defined limits to prevent excessive usage. However, you can potentially increase your limits by assigning a higher access level, such as Basic + Test Plans, to the identities used by your application. This way, you could temporarily qualify for higher rate limits. Once you're done utilizing the higher limits for heavy usage, you can revert the access level to save costs.
• Currently, Azure DevOps does not provide an option to suppress or redirect resource consumption notifications to a specific mailbox or distribution group. The notifications are sent out to members of the PCA group by default. However, you might be able to create custom notifications or workflows using Azure DevOps service hooks to achieve similar results, though this approach requires additional setup.

To manage your OAuth app's identity better, be aware of Azure DevOps throttling strategies. Review best practices on rate limits and usage monitoring to optimize your requests.

Keep an eye on your organization settings and ensure that you’re not exceeding the rate limits to avoid future delays and notifications.

Hope it helps!

---

Please do not forget to click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you.