dt-msgraph
The Most Comprehensive Rust SDK for Microsoft Graph API
Build blazing-fast, secure, and highly scalable enterprise applications with production-grade Microsoft Graph API support — from background daemons to massive web services.

What is dt-msgraph?
dt-msgraph is a Rust SDK (software development kit) for the Microsoft Graph API — the unified API that powers Microsoft 365, Azure Active Directory (Entra ID), Outlook, Teams, SharePoint, OneDrive, Planner, and more. It gives Rust developers a strongly-typed, async-first, production-ready way to authenticate against Microsoft's identity platform and call every major Graph module without writing raw HTTP requests by hand.
It is designed for real production workloads: background daemons processing thousands of mailboxes, serverless functions with cold-start constraints, desktop applications built with Tauri, and enterprise middle-tier APIs that need On-Behalf-Of authentication — not just scripts and demos.
Why Rust for Microsoft Graph?
Traditional Microsoft Graph SDKs in Python, C#, or Node.js carry the overhead of their runtimes: garbage collection pauses, heavier memory footprints, and thread-blocking architectures that show up under real concurrent load. dt-msgraph is built in Rust specifically to avoid all three:
- No Garbage CollectorRust's ownership model means no GC pauses, ever. Response latency stays predictable even under heavy concurrent load, which matters most in exactly the enterprise scenarios (background sync daemons, high-throughput middle-tier APIs) this SDK targets.
- Compiled to Native Machine CodeVia LLVM, dt-msgraph compiles down to native binaries with none of the startup overhead of an interpreted or JIT-compiled runtime.
- Memory Safety Without Manual ManagementRust's borrow checker eliminates entire classes of bugs (use-after-free, data races, null pointer dereferences) at compile time, which matters enormously for code that's handling access tokens and client secrets.
Speed & Performance: dt-msgraph vs Others
| Feature | dt-msgraph (Rust) | Typical C#/Java SDK | Typical Python/Node SDK |
|---|---|---|---|
| Memory footprint | ~10x lower | Baseline | Higher (interpreter overhead) |
| Garbage collection pauses | None | Yes | Yes |
| Cold start (serverless) | Milliseconds | Seconds | Hundreds of ms – seconds |
| Concurrent token reads | Thousands, non-blocking | Thread-pool limited | Single-threaded (GIL) or event-loop bound |
| Compiled binary | Native | JIT/bytecode | Interpreted |
How dt-msgraph achieves this:
- 10x Less Memory — runs with a fraction of the memory footprint compared to C# or Java SDKs, making it ideal for serverless functions (AWS Lambda / Azure Functions) or edge deployments where memory is billed by the MB-second.
- Zero-Blocking Concurrency — built on
tokioandreqwest. Authentication tokens are managed usingtokio::sync::RwLock, allowing thousands of concurrent threads to read tokens simultaneously without ever blocking the executor. - JSON Batching Optimization — combine up to 20 individual API calls into a single HTTP request using the Graph
$batchAPI, cutting network round-trips and latency dramatically for bulk operations. - Single & Multi-Threaded Execution — run requests on a single thread for simple scripts and CLIs, or scale out across multiple threads/tasks for high-throughput services — the same client works either way, no separate code paths needed.
- Single & Batch Processing, Both Supported — call one endpoint at a time when that's all a task needs, or batch dozens of calls together when processing bulk data (mailboxes, users, files) — the API is built to support both without forcing a single style.
- No Garbage Collection — predictable, ultra-low-latency response times, which matters most under exactly the sustained concurrent load enterprise Graph integrations tend to run under.
Quick Start
Add to your Cargo.toml:
[dependencies]
dt-msgraph = "1.0"
tokio = { version = "1", features = ["full"] }Authenticate and make your first call:
use dt_msgraph::{GraphClient, ClientCredentials};
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let client = GraphClient::client_credentials(
"TENANT_ID",
"CLIENT_ID",
"CLIENT_SECRET",
).await?;
let users = client
.users()
.list()
.select(&["id", "displayName", "mail"])
.top(25)
.send()
.await?;
println!("{:#?}", users);
Ok(())
}That's a working, production-grade authenticated Graph API call in under 15 lines — with automatic token caching, retry-on-429, and pagination handling included by default.
Write Once, Run Anywhere (Cross-Platform)
Because dt-msgraph is compiled to native machine code via LLVM, it runs on virtually every platform and architecture:
Deploy to Linux servers, Kubernetes (AKS), or serverless environments (AWS Lambda, Azure Functions). Extremely fast cold starts compared to interpreted-language SDKs.
Build native Windows (.exe), macOS (.app), or Linux applications. Pairs well with Tauri, Qt, or native UI toolkits for building Microsoft 365-connected desktop tools.
Compile to iOS (AArch64) or Android (JNI/NDK) to power the core logic of mobile applications that need Graph API access.
Ideal for IT admin scripts and background jobs using the DeviceCode or ClientCredentials authentication flows.
Multi-Language Integration (FFI Ready)
dt-msgraph is written in Rust for maximum safety and performance — but an entire backend doesn't need to be rewritten in Rust to use it. Rust's excellent C-interoperability means this SDK integrates into an existing tech stack:
- C/C++ — compile directly as a shared library (.so, .dll, .dylib) and call it natively.
- Python — use PyO3 to create fast native Python bindings for data science or Django/FastAPI backends that need Graph API access without Python's interpreter overhead on the hot path.
- C# / .NET — integrate via P/Invoke to bring Rust's memory safety and speed into existing .NET enterprise applications.
- Java — call the library directly via JNI (Java Native Interface).
- Node.js — compile to WebAssembly (Wasm) or use Node-API (N-API) for native execution inside JavaScript/TypeScript services.
The performance of Rust, inside whatever language a team already uses.
Core Features (A to Z)
1. Enterprise-Grade Authentication
Every authentication flow an enterprise needs, built with zero-trust security principles:
- 6 Built-in Auth Flows:
- Client Credentials — for daemons and unattended background services
- Authorization Code + PKCE — for web applications with user sign-in
- Device Code — for CLI tools and devices without a browser
- Managed Identity / Workload Identity — for Azure VMs and AKS workloads with zero secrets to manage
- On-Behalf-Of (OBO) — for middle-tier APIs calling Graph on behalf of a signed-in user
- ROPC — for legacy migration scenarios
- Smart Token Caching & Auto-Refresh: Tokens are cached in memory and refreshed pre-emptively, five minutes before expiry, so requests never stall waiting on a token refresh mid-flight.
- Sovereign Cloud Support: Full support for Government (GCC, GCC High, DoD) and China clouds via custom Authority URLs, for regulated and public-sector deployments.
- Memory Security: Built-in integration with
zeroize. Client secrets and passwords are cryptographically wiped from memory the moment they're dropped, closing a common memory-inspection attack surface most SDKs leave open.
2. Complete Graph API Coverage (Full CRUD)
Strongly-typed, fluent API builders across virtually every major Graph module — no raw HTTP requests required:
3. Resilience & Error Handling
Built to survive real-world API limits without crashing:
- Smart Retry Engine — automatically handles HTTP 429 Too Many Requests, reading the Retry-After header and applying exponential backoff transparently, with no manual retry logic required.
- Configurable Retries —
MAX_RETRIESis configurable per client depending on workload sensitivity. - Rich Error Parsing — typed Rust
Results that parse complex Microsoft Graph JSON error bodies into human-readable formats for fast debugging.
4. Ergonomic Developer Experience (DX)
ODataQuery::new()
.select(&["id", "displayName", "mail"])
.filter("startswith(displayName, 'A')")
.top(50)
.skip_token("next-page-token")- Automatic Headers — the library automatically injects
ConsistencyLevel: eventualwhen using $search or $count, preventing obscure, hard-to-diagnose API errors. - Automatic Pagination — built-in support to seamlessly fetch and parse
@odata.nextLinkfor large data sets, without manual loop-and-fetch boilerplate. - Strongly Typed Models — no string-matching. Rust Enums for statuses,
chrono::DateTime<Utc>for all dates.
dt-msgraph vs Other Microsoft Graph SDKs
| Feature | dt-msgraph | graph-rs-sdk | Official Python SDK | Official C# SDK | Official Node.js SDK |
|---|---|---|---|---|---|
| Language | Rust | Rust | Python | C#/.NET | TypeScript/JS |
| Auth flows built-in | 6 (incl. Managed Identity, OBO) | Partial | Via MSAL | Via MSAL | Via MSAL |
| Sovereign cloud support | Built-in | Not documented | Manual config | Manual config | Manual config |
| Memory-safe secret handling (zeroize) | Built-in | Not documented | N/A (GC'd runtime) | N/A (GC'd runtime) | N/A (GC'd runtime) |
| JSON batching ($batch) | Built-in | Manual | Manual | Manual | Manual |
| Automatic 429 retry + backoff | Built-in | Manual | Via middleware | Via middleware | Via middleware |
| FFI bindings for other languages | Python, C#, Java, Node, C/C++ | No | N/A | N/A | N/A |
| Memory footprint | Lowest (no GC) | Low (no GC) | High | Medium | High |
| Cross-platform desktop/mobile compile targets | Windows, macOS, Linux, iOS, Android | Partial (no macOS interactive-auth) | Backend-only | Backend-only | Backend-only |
| Cold start (serverless) | Milliseconds | Milliseconds | Seconds | Seconds | Hundreds of ms |
dt-msgraph and graph-rs-sdk are both Rust-native, which already puts them ahead of GC'd-runtime SDKs on memory and latency. Where dt-msgraph goes further is sovereign cloud support, built-in memory-safe secret handling, FFI bindings for non-Rust teams, and a fully built-out On-Behalf-Of flow for middle-tier API scenarios — the pieces that turn a fast HTTP client into something an enterprise security team will actually sign off on.
Who Should Use dt-msgraph?
- Backend/platform engineers building high-throughput services that talk to Microsoft 365 at scale and can't afford GC pauses under load.
- Enterprise security teams that require Managed Identity, sovereign cloud support, or memory-safe secret handling as a baseline, not an afterthought.
- Desktop app developers using Tauri or native toolkits who want a Microsoft Graph client that compiles natively instead of bundling a runtime.
- Polyglot teams who want Rust's performance inside an existing Python, C#, Java, or Node.js codebase via FFI, without a full rewrite.
- DevOps/IT automation engineers writing CLI tools and background daemons against Client Credentials or Device Code flows.
FAQ
QIs there an official Rust SDK for Microsoft Graph?
AMicrosoft does not currently publish an official first-party Rust SDK for Microsoft Graph (unlike Python, C#, Java, and TypeScript, which do have official Microsoft SDKs). dt-msgraph and the community-maintained graph-rs-sdk are the two actively maintained Rust options.
QHow does dt-msgraph handle rate limiting (HTTP 429)?
AAutomatically. The built-in retry engine reads the Retry-After header on a 429 response and applies exponential backoff transparently — no manual retry loop is needed in application code.
QDoes dt-msgraph support Azure Government or GCC High?
AYes. Sovereign cloud support for Government (GCC, GCC High, DoD) and China clouds is built in via custom Authority URLs.
QCan I use dt-msgraph from Python or C# instead of Rust directly?
AYes. dt-msgraph is FFI-ready — PyO3 bindings for Python, P/Invoke for .NET, JNI for Java, and Wasm/N-API for Node.js all let non-Rust teams call the same underlying Rust implementation natively.
QDoes dt-msgraph support Managed Identity for Azure VMs and AKS?
AYes. Managed Identity / Workload Identity is one of the six built-in authentication flows, requiring zero stored secrets when running on Azure infrastructure.
QIs dt-msgraph suitable for serverless (AWS Lambda / Azure Functions)?
AYes — the combination of a ~10x smaller memory footprint versus typical C#/Java SDKs and millisecond cold starts (native compilation, no runtime bootstrap) makes it well-suited to serverless specifically.
QDoes it support On-Behalf-Of (OBO) authentication for middle-tier APIs?
AYes, OBO is one of the six built-in auth flows, for APIs that need to call Microsoft Graph using the identity of a user who's already authenticated to the calling API.
QWhat Rust async runtime does dt-msgraph use?
Atokio, with reqwest as the HTTP client, and tokio::sync::RwLock for non-blocking concurrent token access.
QDoes dt-msgraph support both single-threaded and multi-threaded use?
AYes. The same client works for a simple single-threaded script or CLI as well as a multi-threaded, high-concurrency service — no separate setup or code path is needed to scale from one to the other.
QCan I make single API calls and batch calls with the same client?
AYes. dt-msgraph supports both single request calls and batched requests (up to 20 calls combined via the Graph $batch API) side by side, so a call can be made one at a time when that's simplest, or batched when processing bulk data.
Licensing
dt-msgraph is a commercial SDK with a free trial.
- Trial — full SDK, free to use for evaluation but restricted to a maximum of 5 users and 50 items.
- Purchase — buy a license and receive a license file. Use it to activate the SDK (.dll), which removes all limits (unlimited items and users) for full production use.
Ready to build?
Try the full SDK free — buy a license when you're ready for production, activate with your license file.