rate limit quotas for login requests in Azure Active Directory (Azure AD)

Question

I would like to know how to validate how many token from the rate-limit bucket i'm using for each login via Azure Ad in order to not get into rate limit scenarios i saw this page https://learn.microsoft.com/en-us/graph/throttling-limits#identity-and-access-service-limits however im not sure how to actual calculate each login flow as described in the table in the page there are several request type taht related to the flow and each got different request costs is there azure application that monitor the exact number or request in the account so i will be able to isolate in development production or sometihing similar? i tried to query with azure-cli but didnt got the needed info tnx

Answer 1

There is no direct way to validate how many tokens from the rate-limit bucket you are using for each login. Instead, you can monitor your application for HTTP 429 (Too Many Requests) responses, as these indicate that your application has exceeded its quota. You can also look at the HTTP headers of the response to get more information about the throttling behavior.

The following headers can provide more information:

• x-ms-throttle-priority: This response header indicates the priority level of the request that was throttled.
• Retry-After: This response header indicates the number of seconds that the user should wait before resending the throttled
• x-ms-throttle-scope: vfor example, Tenant_Application/ReadWrite/9a3d526c-b3c1-4479-ba74-197b5c5751ae/0785ef7c-2d7a-4542-b048-95bcab406e0b. Indicates the scope of throttling with the following format <Scope>/<Limit>/<ApplicationId>/<TenantId|UserId|ResourceId>

For more info see https://learn.microsoft.com/en-us/graph/throttling-limits#request-headers

Also note that the link you share is for Graph API service limits, For Entra ID limits see https://learn.microsoft.com/en-us/entra/identity/users/directory-service-limits-restrictions