Building enterprise apps with SharePoint Embedded: limits, throttling and permissions
SharePoint Embedded guidance for moving apps to production has been updated. It covers container and tenant limits, handling throttling, narrower Graph permissions and Office co-authoring. For developers building on the Microsoft 365 platform, it offers concrete planning and security points.
Key points
- Include the 2 million sites and containers tenant ceiling and the 40 searchable columns per container in your capacity planning.
- API limit: 12,000 resource units per minute per app per tenant; verify current values before production.
- On 429 or 503, honor Retry-After, cap retries with backoff, and reduce concurrency instead of amplifying load.
- Prefer delegated access so actions are tied to the user; keep app-only permissions as narrow as possible.
- FileStorageContainer.Selected limits access to specific containers instead of all files through Files.Read.All.
- Use Office co-authoring for document editing rather than building your own real-time editing stack.
SharePoint Embedded, a platform for building apps on isolated file containers, has new guidance for taking apps to production. Containers count toward a tenant-wide limit of 2 million sites and containers, and each container can now hold up to 40 searchable columns. The API limit is 12,000 resource units per minute per app per tenant, which the post says is up to 9.6 times the SharePoint Online limit for a tenant with up to 1,000 licenses. For throttling, treat 429 and 503 responses as temporary, honor Retry-After, cap retries and reduce concurrency.
On governance, apps can now use Entra ID or Microsoft 365 security groups as service principals, and narrower Graph permissions such as FileStorageContainer.Selected can replace broad ones like Files.Read.All. Apps can also hand editing to Office co-authoring, which brings AutoSave and version history without custom collaboration code. A preview MCP server lets coding agents provision containers and container types from plain-language requests.
Real-world use
- A multi-tenant SaaS app that creates one container per client needs to plan around tenant limits and throttling from day one.
- A line-of-business app that creates a container per activity can use narrow FileStorageContainer.Selected permissions for operations such as file preview.
- A document portal that opens Word, Excel or PowerPoint files can offer co-authoring, AutoSave and version history without building them.
Why it matters
Knowing the limits and throttling behavior before launch keeps your app stable under load. Narrower Graph permissions and Office co-authoring also reduce both security exposure and the amount of collaboration code you have to write.
Related stories
- Mastering Rate Limiting and Resource Governance for MCP Servers at ScaleDEV Community: #aspnetcore1 d ago
- Azure SDK October 2026: Azure Core, managed identity and Cosmos DB for Rust 1.0.0Azure SDK Blog5 d ago
- A secure enterprise chat with React, .NET 10 and Microsoft FoundryDEV Community: #dotnet1 d ago