Chat with us, powered by LiveChat

Blog

Back

Exchange Online PowerShell Throttling in Office 365

19 Nov 2013 by Emma Robinson

If you do any kind of heavy work with Exchange Online in PowerShell you’ve probably come across throttling. This is applied at the Exchange Server level and restricts the amount of resources you can consume in the Office 365 environment.

Whilst they’re annoying and make our life miserable, we can understand why they are in place and have learned to work within their limits.

This article will aim to share what we’ve learnt about Office 365 Exchange Online throttling when it comes to PowerShell connections.

The Office 365 Exchange Online Throttling Policy

Firstly, let’s look at the default Office 365 throttling policy.

Throttling Type Value Description
PowerShellMaxConcurrency 3 The Number of simulatenous PowerShell Sessions a user can have open to Exchange Online
PowerShellMaxTenantConcurrency 9 The Number of simulatenous PowerShell Sessions a tenant can have open to Exchange Online
PowerShellMaxCmdlets 200 The number of cmdlets that can be run per PowerShellMaxCmdletsTimePeriod without being throttled
ExchangeMaxCmdlets 25 This parameter is similar to PowerShellMaxCmdlets but only for Exchange Online cmdlets
PowerShellMaxCmdletsTimePeriod 5 The time period, in seconds, that a user can run the number of cmdlets defined by the PowerShellMaxCmdlets or ExchangeMaxCmdlets parameter
PowerShellMaxCmdletQueueDepth 50 Defines the number of operations that a user can run simultaneously
PowerShellMaxDestructiveCmdlets 120 The number of cmdlets that can be run per PowerShellMaxDestructiveCmdletsTimePeriod without being throttled.  A desuctive cmdlet is one that makes changes to the Office 365 environment (Such as Set or New cmdlets)
PowerShellMaxDestructiveCmdletsTimePeriod 60 The time period, in seconds, that a user can run the number of cmdlets defined by the PowerShellMaxDestructiveCmdlets parameter

There are very clearly defined boundaries as to how many cmdlets you can run and how quickly.

It may seem like you have a lot of room to play with, but when you start piping cmdlets together such as Get-Mailbox | Get-MailboxStatistics you very quickly consume your whole throttling budget – especially if you have a lot of mailboxes in your tenant.

Most of these limits apply to the User Account that is connected to Exchange Online. You can get around some of these by using different user accounts for different tasks.

Exceeding the Throttling Policy

If you exceed any of the limits mentioned above, you will be throttled by Exchange Online and your scripts will run slower. This will result in “Mirco Delay” warnings being displayed in PowerShell that look something like this.

WARNING: Micro delay applied. Actual delayed: 12 msecs
WARNING: Micro delay applied. Actual delayed: 33 msecs, Enforced

Microsoft has a support article about this problem but it is not very useful.

If you continually breach this throttling policy, your account may become locked for a certain period of time. This is bad as it means you cannot perform any Exchange Online actions whilst the account is locked.

A locked account will show an error in PowerShell that looks something like this:

This operation exceeds the throttling budget for policy part ‘LocalTime’, policy value ‘3000000’, Budget type: ‘PowerShell’. Suggested backoff time 887405440 ms.
(PolicyDN: CN=OrganizationThrottlingPolicy,CN=Global Settings, …;
Snapshot: Owner: Sid~XXXXXXXXX~PowerShell~false
BudgetType: PowerShell
ActiveRunspaces: 0/3\
Balance: -4.467027E+08/1800000/-3000000
PowerShellCmdletsLeft: 199/200
ExchangeCmdletsLeft: 24/25
CmdletTimePeriod: 5
DestructiveCmdletsLeft: 120/120
DestructiveCmdletTimePeriod: 60
QueueDepth: 50
MaxRunspacesTimePeriod: 60
RunSpacesRemaining: 5/5
LastTimeFrameUpdate: 08/21/2013 8:22:51 PM
LastTimeFrameUpdateDestructiveCmdlets: 08/21/2013 8:22:51 PM
LastTimeFrameUpdateMaxRunspaces: 08/21/2013 8:22:51 PM
Locked: True
LockRemaining: 10.06:30:05.4400000

The important part here is the Locked: True and LockRemaining: 10.06:30:05.4400000 attributes. This tells you that the account is locked and that it will remain locked for 10 days and 6 hours.

Read more Optimizing PowerShell for large Office 365 tenants

If you try to run any Exchange Cmdlets within this lock period it will double the lockout window!

In our experience this time frame is also often incorrect, and we’ve seen accounts become unlocked sooner or later than the LockRemaining time specified.

Changing the Office 365 Throttling Policy

It is almost impossible to get this throttling policy changed.

We have heard of some large companies who were successful in lobbying Microsoft to get their policy modified or increased.

If you want to go down this route we suggest logging a support ticket explaining the business case why you need the policy increased and then get your Microsoft Account Manager or TAM to push the ticket within Microsoft to the correct team. 99% of the time your request will be denied.

Avoiding the throttling policy

Here are some tips to avoid getting throttled:

  • Don’t collect more data than you really need to
  • Use different Office 365 user accounts for different tasks when connecting to Exchange Online using PowerShell
  • Free up PowerShell sessions when you’re done using them by running Get-PSSession | Remove-PSSession
  • Use the -ResultSize switch when using Get-User or Get-Mailbox to limit the number of results returned
  • Use the -Filter switch instead of the Where-Object cmdlet to filter datasets. Filter is applied server side and is much faster.

For more information on Exchange Throttling Policies see:

Exchange 2010 Client Throttling Policies
Understanding Client Throttling Policies