Run into Error 429: RateLimit in Large Environment

[Daniel-CS-Team]

Azurehound Version: 2.1.5

users count=416092

Azurehound throws some errors, but continues to run. When looking into the GraphActivity logs, I can see that a lot of 429-errors are generated.
Example Ouptut from Azurehound (IDs redacted for privacy):

AzureHound v2.1.5
Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io

No configuration file located at C:\Windows\system32\config\systemprofile\.config\azurehound\config.json
No configuration file located at C:\Windows\system32\config\systemprofile\.config\azurehound\config.json
2023-11-17T07:35:48Z INF collecting azure objects...
2023-11-17T07:35:48Z INF finished listing all tenants count=2
2023-11-17T07:35:49Z INF finished listing all roles count=106
2023-11-17T07:35:50Z INF finished listing all role assignments
2023-11-17T07:35:50Z INF finished listing all management groups count=66
2023-11-17T07:35:50Z INF finished listing all management group role assignments
2023-11-17T07:35:51Z INF finished listing all management group descendants
2023-11-17T07:36:00Z ERR unable to continue processing logic apps for this subscription error="json: cannot unmarshal string into Go struct field Recurrence.value.properties.definition.triggers.recurrence.interval of type int" subscriptionId=26*******0b
2023-11-17T07:36:01Z INF finished listing all subscriptions count=128
2023-11-17T07:36:01Z ERR unable to continue processing virtual machines for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing logic apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing key vaults for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing managed clusters for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing key vaults for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing container registries for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing virtual machines for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing automation accounts for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing function apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing virtual machine scale sets for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing web apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing role assignments for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=/subscriptions/ 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing container registries for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId= 9f********bb
2023-11-17T07:36:01Z ERR unable to continue processing role assignments for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=/subscriptions/52*******40
2023-11-17T07:36:01Z ERR unable to continue processing managed clusters for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z ERR unable to continue processing logic apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing function apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing automation accounts for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing automation accounts for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all automation accounts
2023-11-17T07:36:01Z ERR unable to continue processing web apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing managed clusters for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z INF finished listing all managed clusters
2023-11-17T07:36:01Z INF finished listing all automation account role assignments
2023-11-17T07:36:01Z INF finished listing all managed cluster role assignments
2023-11-17T07:36:01Z ERR unable to continue processing virtual machines for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z ERR unable to continue processing key vaults for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z ERR unable to continue processing logic apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all logic apps
2023-11-17T07:36:01Z ERR unable to continue processing virtual machine scale sets for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=52*******40
2023-11-17T07:36:01Z ERR unable to continue processing function apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all function apps
2023-11-17T07:36:01Z ERR unable to continue processing role assignments for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=/subscriptions/29***********45
2023-11-17T07:36:01Z INF finished listing all subscription role assignments
2023-11-17T07:36:01Z ERR unable to continue processing virtual machine scale sets for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all virtual machine scale sets
2023-11-17T07:36:01Z ERR unable to continue processing container registries for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z ERR unable to continue processing web apps for this subscription error="map[error:map[code:DisallowedOperation message:The current subscription type is not permitted to perform operations on any provider namespace. Please use a different subscription.]]" subscriptionId=29***********45
2023-11-17T07:36:01Z INF finished listing all web apps
2023-11-17T07:36:01Z INF finished listing all function app role assignments
2023-11-17T07:36:01Z INF finished listing all subscription user access admins
2023-11-17T07:36:01Z INF finished listing all vm scale set role assignments
2023-11-17T07:36:01Z INF finished listing all web app role assignments
2023-11-17T07:36:01Z INF finished listing all logic app role assignments
2023-11-17T07:36:03Z INF finished listing all resource groups
2023-11-17T07:36:03Z INF finished listing all resource group role assignments
2023-11-17T07:36:05Z INF finished listing all apps count=2154
2023-11-17T07:36:05Z INF finished listing all app owners
2023-11-17T07:36:17Z INF finished listing all key vaults
2023-11-17T07:36:17Z INF finished listing all key vault role assignments
2023-11-17T07:36:19Z INF finished listing all virtual machines
2023-11-17T07:36:19Z INF finished listing all virtual machine role assignments
2023-11-17T07:36:30Z INF finished listing all container registries
2023-11-17T07:36:30Z INF finished listing all container registry role assignments
2023-11-17T07:36:52Z ERR unable to continue processing members for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=f0************6a
2023-11-17T07:36:52Z ERR unable to continue processing owners for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=3d************33
2023-11-17T07:36:52Z ERR unable to continue processing owners for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=27************f2
2023-11-17T07:36:52Z ERR unable to continue processing owners for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=7c************16
2023-11-17T07:36:52Z ERR unable to continue processing owners for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=74************d6
2023-11-17T07:36:53Z ERR unable to continue processing members for this group error="unable to complete the request after 3 attempts: %!w(<nil>)" groupId=03************0d
2023-11-17T07:36:53Z ERR unable to continue processing owners for this device error="unable to complete the request after 3 attempts: %!w(<nil>)" deviceId=0b************c4
2023-11-17T07:36:54Z ERR unable to continue processing owners for this device error="unable to complete the request after 3 attempts: %!w(<nil>)" deviceId=0b************94
2023-11-17T07:38:37Z INF finished listing all service principals count=9913
2023-11-17T07:38:37Z INF finished listing all app role assignments
2023-11-17T07:38:38Z INF finished listing all service principal owners
2023-11-17T07:42:48Z INF finished listing all users count=416092

[Daniel-CS-Team]

FYI: We tried to open a Ticket with Microsoft to get the RateLimit increased, but since Azurehound uses the Beta-API, there is no support at all from Microsoft...