Increasing Microsoft Graph Per-Mailbox Throttling Limits (PUT/POST/PATCH & Concurrency)
I am referring to the per-mailbox throttling limits documented here: https://learn.microsoft.com/en-us/graph/throttling-limits#limits-per-mailbox Specifically: 150 MB limit for PUT/POST/PATCH requests within a 5-minute window 4 concurrent requests per mailbox In a multi-tenant SaaS application scenario, these limits can become restrictive when processing large volumes of mailbox data. I would like clarification on the following: Is it possible to request an increase in these per-mailbox limits through Microsoft (e.g., via support or a formal quota increase request)? Are there recommended architectural patterns or best practices to efficiently handle high-throughput scenarios while staying within these limits? Can tenant administrators (our customers) configure or influence these limits through Microsoft 365 admin settings? Any official guidance or recommendations would be highly appreciatedUnable to use MS Graph DLP Api's to use with my Entra Registered App
In purview, I have set of policies in DLP, where I have registered to block the US SSN in the text contents and I have created different policies in all of them I have selected the available locations: Exchange email - All accounts SharePoint sites OneDrive accounts - All accounts Teams chat and channel messages - All accounts Devices - All accounts Microsoft Defender for Cloud Apps On-premises repositories And selected action as block all, in all of them for the rule and enabled the rule (not in simulation mode) Now, I have the app registered in Entra and I try to use the following API's https://learn.microsoft.com/en-us/graph/api/userprotectionscopecontainer-compute?view=graph-rest-1.0 https://learn.microsoft.com/en-us/graph/api/userdatasecurityandgovernance-processcontent?view=graph-rest-1.0&tabs=http But whenever I use the compute api I can see i'm only getting curl -X POST https://graph.microsoft.com/v1.0/users/5fd51e08-c5f1-4298-b79b-a357eaa414ff/dataSecurityAndGovernance/protectionScopes/compute\ -H 'Authorization: Bearer <ACCESS_TOKEN>'\ -H 'Content-Type: application/json' -d '{ "activities": "uploadText,downloadText" }' { "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#Collection(microsoft.graph.policyUserScope)", "value": [ { "activities": "uploadText,downloadText", "executionMode": "evaluateOffline", "locations": [ { "@odata.type": "#microsoft.graph.policyLocationApplication", "value": "b48106d9-1cdb-4d90-9485-fe2b6ee78acf" } ], "policyActions": [] } ] } My sample App's Id is showing up but always with `evaluateOffline` I don't know why it always gives 'evaluteOffline' and policyActions is always empty array Also, I can see my Entra registered app is showing up here in the value of the locations And when I use the processContent api , I always get modified in the response and nothing else like below: curl -XPOST https://graph.microsoft.com/v1.0/users/5fd51e08-c5f1-4298-b79b-a357eaa414ff/dataSecurityAndGovernance/processContent \ -H 'Authorization: <ACCESS TOKEN>'\ -H 'Content-Type: application/json' -d '{ "contentToProcess": { "contentEntries": [ { "@odata.type": "microsoft.graph.processConversationMetadata", "identifier": "07785517-9081-4fe7-a9dc-85bcdf5e9075", "content": { "@odata.type": "microsoft.graph.textContent", "data": "Please process this application for John VSmith, his SSN is 121-98-1437 and credit card number is 4532667785213500" }, "name": "Postman message", "correlationId": "d63eafd2-e3a9-4c1a-b726-a2e9b9d9580d", "sequenceNumber": 0, "isTruncated": false, "createdDateTime": "2026-04-06T00:23:20", "modifiedDateTime": "2026-04-06T00:23:20" } ], "activityMetadata": { "activity": "uploadText" }, "deviceMetadata": { "operatingSystemSpecifications": { "operatingSystemPlatform": "Windows 11", "operatingSystemVersion": "10.0.26100.0" }, "ipAddress": "127.0.0.1" }, "protectedAppMetadata": { "name": "Postman", "version": "1.0", "applicationLocation": { "@odata.type": "microsoft.graph.policyLocationApplication", "value": "b48106d9-1cdb-4d90-9485-fe2b6ee78acf" } }, "integratedAppMetadata": { "name": "Postman", "version": "1.0" } } }' In the above request I have mentioned some sample US Security SSN, but the response I get is { "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.processContentResponse", "protectionScopeState": "notModified", "policyActions": [], "processingErrors": [] } But Ideally I want to see whether I can get the content is valid or not, for example in the above request, it has SSN, so ideally I should get restrictAction or something right? Or is that evaluateInline is not available or something? Note that I have purchased E5 and assigned to the user who is trying this Also, whenever I choose to create a Policy in DLP , I got two options And Lets say I choose "Enterprise applications & devices", what happens is in the Locations, I'm seeing only these as the options: And If I choose the "Inline Traffic", i'm seeing only these options In Unmanaged, I'm seeing the following And in the Enforcement Options, I have the following : And in the "Advanced DLP rules" I'm seeing only these So, can you tell me the exact steps in the Purview suite, I couldn't where to mention the Entra registered App, I searched and I couldn't find one But in the compute endpoint, https://learn.microsoft.com/en-us/graph/api/userprotectionscopecontainer-compute?view=graph-rest-1.0 I'm getting my app but only with "evaluateOffline" and with that ETag, If I use the processContent Api, its not giving anything except as I mentioned above in the post
Channel-message change notification subscription stopped sending reauthorizationRequired event
Hi Team, We are using Microsoft feature: change notification subscription to create subscriptions for channel-message and chat-messages resources. We use these subscriptions to deliver the messages sent in MS teams to our internal applications. We are using application access token to create the change notification subscriptions. After creating subscriptions, we were able to get the change notifications for channel-message/chat-message resources on our webkook endoint. Also we were able to get the reauthorizationRequired event on lifecycle change notification webhook enpoint. For every reauthorizationRequired event we use to renew the subscription by 70 hours using the application access token. For our channel-message/chat-message subscriptions we only received the reauthorizationRequired events for first couple of days and after that we stopped receiving those events. Because of this we were not able to renew the subscriptions. Could you please guide us to understand the root cause of this issue. Thanks & Regards, Vaibhav Medhekar
Trying to use Remove-MgGroupMemberByRef but getting errors
We are trying to setup an automation of removing users from a security group at the end of each day. I want to use the Remove-MgGroupMemberByRef cmdlet but I cannot for the life of me get it working. I am getting the below error: Remove-MgGroupMemberByRef Remove-MgGroupMemberByRef : The 'Remove-MgGroupMemberByRef' command was found in the module 'Microsoft.Graph.Groups', but the module could not be loaded. For more information, run 'Import-Module Microsoft.Graph.Groups'. At line:1 char:1 + Remove-MgGroupMemberByRef + ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (Remove-MgGroupMemberByRef:String) [], CommandNotFoundException + FullyQualifiedErrorId : CouldNotAutoloadMatchingModule So I try to import the module based on the error: import-module Microsoft.Graph.Groups Import-Module : Could not load file or assembly 'Azure.Core, Version=1.33.0.0, Culture=neutral, PublicKeyToken=92742159e12e44c8' or one of its dependencies. The system cannot find the file specified. At line:1 char:1 + import-module Microsoft.Graph.Groups + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Import-Module], FileNotFoundException + FullyQualifiedErrorId : System.IO.FileNotFoundException,Microsoft.PowerShell.Commands.ImportModuleCommand What I have done to try resolve: - Installed latest version of MS Graph Module 2.6.1 (Including Beta) - Installed latest version of Az module 10.4.1 - Tried running both standard and beta versions of the command but same issue - Set execution policy to unrestricted temporarily for testing We connect using a certificate / service principal which has satisafactory permissions to remove users from groups. Hope someone can help!
Field Name "_LikeCount and _CommentCount" is not recognize in Graph Explorer
Hi I'm trying to query most liked and commented news in SharePoint Site Pages however when trying to order descending using _LikeCount and _CommentCount i received this error: A provided field name is not recognized I don't have any issue with other fields except these two. https://graph.microsoft.com/v1.0/sites/{ID}/lists/Site Pages/items?$filter=fields/PromotedState eq 2&expand=fields($select=createdDateTime,BannerImageUrl,PromotedState,FileLeafRef,AuthorLookupId,Modified,_CommentCount,_LikeCount,Title,Description,LinkTitle)&$top=5&$orderby=fields/_LikeCount desc Any help is appreciated. Thanks!When Sending an Adaptive Card to Teams via MS Graph Can The Copy Link & Title Bar Be Removed?
When using MS Graph and I use the message endpoint to https://docs.microsoft.com/en-us/graph/api/channel-post-message?view=graph-rest-1.0&tabs=http to a channel in MS Teams, and that message includes an adaptive card as an attachment, I always end up with a blank space/padding at the top of the card, and 3-dot menu to the right (with a Copy option). This padding doesn't seem to appear on any of the examples given in the documentation, and the blank space at the top of all my cards looks a bit naff. Is there a way to remove this spacing? Or, alternatively, is there a way to add content into this space, and alter the options shown under the 3-dot menu? Endpoint being used... https://graph.microsoft.com/v1.0/teams/{team-id}/channels/{channel-id}/messages Example request body being used... { "body": { "contentType": "html", "content": "<attachment id=\"4465B062-EE1C-4E0F-B944-3B7AF61EAF40\"></attachment>" }, "attachments": [ { "id": "4465B062-EE1C-4E0F-B944-3B7AF61EAF40", "contentType": "application/vnd.microsoft.card.adaptive", "content": "{\n \"type\": \"AdaptiveCard\",\n \"$schema\": \"http://adaptivecards.io/schemas/adaptive-card.json\",\n \"version\": \"1.3\",\n \"body\": [\n {\n \"type\": \"TextBlock\",\n \"size\": \"Large\",\n \"weight\": \"Bolder\",\n \"text\": \"My News Item\",\n \"wrap\": true\n }\n ],\n \"actions\": [\n {\n \"type\": \"Action.OpenUrl\",\n \"title\": \"View\",\n \"url\": \"https://bing.com\"\n }\n ]\n }" } ] }Device neutral storage of applications data using OneDrive to manage a users own applications data
When designing an application we need to be mindful about privacy and security concerns when accessing data within the application, in particular taking into consideration anything that is sensitive, personalised, or should not be written to an insecure local disk. In the medical context, for example, every day clinicians may have to use several machines, often connecting to a local area network to retrieve their profile, settings, and data. This must be done in a safe and reliable way. Enter Microsoft Graphs API. By using this API we can offload much of the management of login security to Microsoft. The API provides a wide range of new functionality that can be integrated into an application such as storing data of personal relevance generated by an app to a user’s own OneDrive account. Thus any device with the same application can be logged in via Single Sign-On (SSO) and retrieve where that user left off.
