Forum Discussion

zlate81's avatar
zlate81
Copper Contributor
Feb 24, 2025

Advanced hunting API CpuQuotaExceeded

I'm getting the following error quite often when I threat hunt.

 

Error in API call [429] - Too Many Requests {"error": {"code": "CpuQuotaExceeded", "message": "You have exceeded processing resources allocated to this tenant. You can run queries again in 2194 seconds"

 

 

How do I check what is using all the API-Cpu and what are the specifications on Cpu usage i.e what is the Quota and are they different based on license?

3 Replies

Sort By
  • zlate81's avatar
    zlate81
    Copper Contributor
    Feb 25, 2025

    Thanks, for the reply.

     

    I notice after I wrote this post that there is a GUI from quota here https://security.microsoft.com/advanced-hunting/quotareport

    • luchete's avatar
      luchete
      Steel Contributor
      Feb 26, 2025

      Hey zlate81,

      Glad you find your way to identify the issue. If my previous question was useful for you, would you mind to mar this thread as solved?

      Regards!

  • luchete's avatar
    luchete
    Steel Contributor
    Feb 25, 2025

    Hi zlate81,

    The "CpuQuotaExceeded" error happens when the API hits the resource limit for your tenant.

    Unfortunately, there isn’t a direct way to see exactly what is using up all the CPU resources, but you can try reducing the complexity of your queries or spreading them out over time. The CPU usage limits can vary depending on your license, and the quota might be higher for premium or higher-tier plans. You can check your current limits in the Microsoft Defender documentation.

    Regards!

Resources