Why Your M365 Backup Just Got Slower

If your M365 backups ran noticeably faster six months ago, this is probably why.

As of March 1, 2026, Microsoft has started actively enforcing a rule that most of the backup industry has been quietly working around for years. The rule is simple: one application registration per backup task. No exceptions. And it changes the speed equation for every M365 backup product on the market.

Section 3.7 of Microsoft’s Terms of Use has always prohibited attempts to circumvent API usage limits. Until now, enforcement was effectively non-existent. Backup vendors discovered that by registering multiple applications against the same tenant, they could run API requests in parallel—tripling or quadrupling their throughput against Microsoft’s Graph API.

Microsoft is now detecting this automatically. If a vendor was using three separate application registrations to back up Exchange, SharePoint, and OneDrive simultaneously—or using multiple registrations to speed up a single workload—Microsoft shuts down the extra registrations on the backend. No warning. No grace period.

The Graph API rate limits govern how quickly data can be read from your tenant. In our testing, initial backup throughput under single-application limits typically sits around 1TB per 24 hours. That’s the real number. Any vendor that appeared significantly faster than this before March 2026 was likely leveraging multi-application parallelism that Microsoft has now blocked.

This hits initial backups hardest—the first full scan of your environment. Incremental backups, which only capture changes since the last run, are less affected. But if you’re onboarding a new backup product or adding a large tenant, expect that first backup to take considerably longer than vendor marketing may have suggested.

Every M365 backup vendor that uses the Graph API. That’s the entire market. But the practical impact splits into two camps:

Vendors already operating within single-application limits will see no change. Their architecture was compliant. Their speeds were real.

Vendors that relied on multiple application registrations will see their initial backup speeds drop—potentially by 50–75%—to whatever Microsoft’s single-application rate limits allow. If a vendor previously recommended setting up separate admin accounts for different workloads, that approach is now non-compliant and may stop working without warning.

If you’re running a parallel backup configuration today, check with your vendor. Now, not next quarter.

1. Does your product use a single application registration or multiple registrations to process M365 backups?
2. How does your initial backup throughput compare under single-application API limits?
3. Have you made any changes to your architecture or documentation in response to Microsoft’s March 2026 enforcement?

Vendors operating within single-application limits should be able to answer these directly and specifically. If the answers are vague, it’s worth understanding how the vendor’s previous architecture handled API limits—and whether the speed you were sold still holds.

This enforcement doesn’t exist in isolation. Microsoft is also retiring Exchange Web Services (EWS) on October 1, 2026, cutting off the legacy API that many backup vendors still use for Exchange data. Together, these two changes signal a clear direction: Microsoft is tightening control over how third-party applications interact with M365 data.

For IT teams managing M365 backup, the action is clear. Verify your vendor’s architecture against current Microsoft policies. What worked six months ago may not work today—and what works today may not work in October.