Azure AD service limits and restrictions

This article contains the usage constraints and other service limits for the Azure Active Directory (Azure AD) service. If you’re looking for the full set of Microsoft Azure service limits, see Azure Subscription and Service Limits, Quotas, and Constraints.

Here are the usage constraints and other service limits for the Azure Active Directory (Azure AD) service.

Category Limit
Directories A single user can belong to a maximum of 500 Azure AD directories as a member or a guest.
A single user can create a maximum of 200 directories.
Domains You can add no more than 900 managed domain names. If you set up all of your domains for federation with on-premises Active Directory, you can add no more than 450 domain names in each directory.
  • A maximum of 50,000 Azure AD resources can be created in a single directory by users of the Free edition of Azure Active Directory by default. If you have at least one verified domain, the default Azure AD service quota for your organization is extended to 300,000 Azure AD resources. This service limit is unrelated to the pricing tier limit of 500,000 resources on the Azure AD pricing page. To go beyond the default quota, you must contact Microsoft Support.
  • A non-admin user can create no more than 250 Azure AD resources. Both active resources and deleted resources that are available to restore count toward this quota. Only deleted Azure AD resources that were deleted fewer than 30 days ago are available to restore. Deleted Azure AD resources that are no longer available to restore count toward this quota at a value of one-quarter for 30 days. If you have developers who are likely to repeatedly exceed this quota in the course of their regular duties, you can create and assign a custom role with permission to create a limitless number of app registrations.
Schema extensions
  • String-type extensions can have a maximum of 256 characters.
  • Binary-type extensions are limited to 256 bytes.
  • Only 100 extension values, across all types and all applications, can be written to any single Azure AD resource.
  • Only User, Group, TenantDetail, Device, Application, and ServicePrincipal entities can be extended with string-type or binary-type single-valued attributes.
  • Schema extensions are available only in the Graph API version 1.21 preview. The application must be granted write access to register an extension.
Applications A maximum of 100 users can be owners of a single application.
Application Manifest A maximum of 1200 entries can be added in the Application Manifest.
  • A user can create a maximum of 250 groups in an Azure AD organization.
  • An Azure AD organization can have a maximum of 5000 dynamic groups.
  • A maximum of 100 users can be owners of a single group.
  • Any number of Azure AD resources can be members of a single group.
  • A user can be a member of any number of groups.
  • By default, the number of members in a group that you can synchronize from your on-premises Active Directory to Azure Active Directory by using Azure AD Connect is limited to 50,000 members. If you need to synch a group membership that's over this limit, you must onboard the Azure AD Connect Sync V2 endpoint API.
  • Nested Groups in Azure AD are not supported within all scenarios

At this time the following are the supported scenarios with nested groups.
  • One group can be added as a member of another group and you can achieve group nesting.
  • Group membership claims (when an app is configured to receive group membership claims in the token, nested groups the signed-in user is a member of are included)
  • Conditional access (when scoping a conditional access policy to a group)
  • Restricting access to self-serve password reset
  • Restricting which users can do Azure AD Join and device registration

The following scenarios DO NOT supported nested groups:
  • App role assignment (assigning groups to an app is supported, but groups nested within the directly assigned group will not have access), both for access and for provisioning
  • Group-based licensing (assigning a license automatically to all members of a group)
  • Office 365 Groups.
Application Proxy
  • A maximum of 500 transactions per second per App Proxy application
  • A maximum of 750 transactions per second for the Azure AD organization

A transaction is defined as a single http request and response for a unique resource. When throttled, clients will receive a 429 response (too many requests).
Access Panel There's no limit to the number of applications that can be seen in the Access Panel per user regardless of assigned licenses.
Reports A maximum of 1,000 rows can be viewed or downloaded in any report. Any additional data is truncated.
Administrative units An Azure AD resource can be a member of no more than 30 administrative units.
Admin roles and permissions
  • A group cannot be added as an owner.
  • A group cannot be assigned to a role.
  • Users' ability to read other users' directory information cannot be restricted outside of the Azure AD organization-wide switch to disable all non-admin users' access to all directory information (not recommended). More information on default permissions here.
  • It may take up to 15 minutes or signing out/signing in before admin role membership additions and revocations take effect.

Next steps