Azure Networking · Rate Limits

Microsoft Azure Networking Rate Limits

Azure Networking management API calls go through Azure Resource Manager (ARM) and the Microsoft.Network resource provider. ARM applies a token-bucket throttling model per region, per subscription, per service principal, per operation type. The Microsoft.Network resource provider applies an additional per-subscription per-region cap (writes/deletes 1,000 per 5 minutes; reads 10,000 per 5 minutes). Throttled requests return HTTP 429 with a Retry-After header. Limits can be raised by support request.

7 Limits Throttle: 429
AzureCloudInfrastructureMicrosoftNetworkingRate Limiting

Limits

ARM subscription reads (token bucket) subscription/region/serviceprincipal
requests_per_second · second
25
Bucket size 250 tokens; refill rate 25 tokens/sec. Global subscription cap is 15× per operation type across all service principals.
ARM subscription writes (token bucket) subscription/region/serviceprincipal
requests_per_second · second
10
Bucket size 200 tokens; refill rate 10 tokens/sec.
ARM subscription deletes (token bucket) subscription/region/serviceprincipal
requests_per_second · second
10
Bucket size 200 tokens; refill rate 10 tokens/sec.
ARM tenant reads tenant
requests_per_second · second
25
Bucket size 250; refill 25/sec.
Microsoft.Network resource provider — write/delete (PUT) subscription/region
requests_per_5_minutes · minute
1000
Per-subscription per-region cap on Microsoft.Network PUT/DELETE.
Microsoft.Network resource provider — read (GET) subscription/region
requests_per_5_minutes · minute
10000
Per-subscription per-region cap on Microsoft.Network GET.
Azure DNS query plane hosted-zone
queries_per_second
see vendor docs
Authoritative resolvers handle very high QPS via anycast; query-plane is not subject to ARM throttling.

Policies

Token bucket algorithm
ARM uses a regional token bucket. Each request consumes a token; tokens refill at the documented rate. When the bucket is empty, requests return 429 with Retry-After.
Exponential backoff with Retry-After
Clients must honor the Retry-After response header. Azure SDKs implement automatic backoff; custom clients should use exponential backoff with jitter.
Multi-instance global cap
The global subscription-wide cap is 15× the per-service-principal limit per operation type to prevent any single principal from saturating the subscription.
getBatch for metrics
Heavy use of the */providers/microsoft.insights/metrics API is a common cause of throttling. Microsoft recommends switching to the metrics:getBatch API to query multiple resources per request.
Limit increase via support
Resource-provider-specific limits can be raised by opening an Azure support ticket; the ARM-level token bucket is generally fixed.
RetryableErrorDueToAnotherOperation
Microsoft.Network may return 429 with code RetryableErrorDueToAnotherOperation when the target resource is locked by a concurrent operation; retry with backoff.

Sources