Microsoft Graph webhook subscriptions deliver duplicate notifications for the same message

Question

We have a NestJS application that subscribes to Microsoft Graph webhooks for Outlook inbox messages using the /subscriptions endpoint with resource users/{email}/mailfolders('Inbox')/messages.

We are consistently receiving duplicate webhook notifications for the same email message. Both notifications carry the

same resourceData.id (MessageId) and arrive within milliseconds of each other.

Observed behavior:

• A single new email arrives in the inbox
  • Our webhook endpoint receives 2 POST requests with the same resourceData.id
  • Both notifications arrive at the same time (within ~100ms)
  • This happens for every email, not occasionally
  Example from our logs: Processing email job: 12506 → MessageId: AAMkADA...AA= Processing email job: 12507 → MessageId: AAMkADA...AA= Both jobs process the same email, which causes duplicate tickets/records in our system. Our setup:
• Single subscription per mailbox (verified — no duplicate subscriptions)
  • Webhook responds with HTTP 202 immediately before processing
  • We recently rotated our Azure AD app credentials (new clientId/clientSecret), but the issue started after that change
  Questions:

1. Is this expected at-least-once delivery behavior for Microsoft Graph webhooks, similar to Azure Service Bus?
2. Could rotating the Azure AD app registration cause temporary duplicate subscriptions or duplicate notifications?
3. Is there any official documentation on the delivery guarantees for Graph webhook notifications?

We have implemented deduplication on our side using the resourceData.id as a unique key, but we want to understand if this is expected behavior or a misconfiguration on our end.