Confusing RU limits for /applications write operations — clarification needed

[nadeem-nasir]

I am implementing automation that creates Azure AD applications and service principals using Microsoft Graph. I am running into frequent 429 Too Many Requests responses, and the documentation around Resource Units (RUs) vs “requests” is unclear.

The documentation states:

“The cost of POST, PATCH, and DELETE operations on the /applications request path depends on the signInAudience type. For apps where the signInAudience is AzureADMyOrg or AzureADMultipleOrgs, the cost is 70,000 requests per 5 minutes.”

Separately, the throttling documentation lists:

Scope	RU Budget	Request Budget
application+tenant pair	S: 3,500 / 10s, M: 5,000 / 10s, L: 8,000 / 10s	3,000 requests / 2.5 min
application	150,000 RU / 20s	35,000 requests / 5 min
tenant	N/A	18,000 requests / 5 min

Questions

1. Does “70,000 requests per 5 minutes” actually mean 70,000 Resource Units, not HTTP requests?
   The wording suggests HTTP requests, but the throttling behavior suggests RU consumption.

2. Which RU scope applies to the following workflow?

   • GET /applications?$filter=displayName eq 'X'
   • POST /applications (create app registration)
   • POST /servicePrincipals (create Enterprise App)
   • POST /applications/{id}/addPassword (create client secret)

3. What is the RU cost of each of these operations?

4. Is addPassword intended to consume the full 70,000 RU tenant-wide budget?

5. What is the recommended design pattern for automation that needs to create multiple applications, service principals, and secrets without hitting throttling?

Thanks in advance for clarification.