Copilot APIs cap at 200 requests per user per hour. Learn 429 error handling, batch retry rules, MSAL token caching, and which national clouds block Copilot APIs entirely.
Microsoft 365 Development
Microsoft 365 Copilot API Auth, Permissions, and Production Readiness: The Foundation Before You Build
Most developers hit a 403 on their first Copilot API call — not because of a misconfiguration, but because the Retrieval and Search APIs are delegated-only by design. This post maps the auth model, exact permission scopes per API surface, app registration choices, and SDK options into a single decision-support guide you can work through before writing your first integration call.