@@ -378,6 +378,23 @@ with `author_id=`/`editor_id=` now raises `TypeError` — pass
 
 ### Fixed
 
+**Runtime**
+
+- **A throttled request now waits the interval the service asked for.**
+  `execute_query_retry` retried a `429`/`503` on its exponential backoff and ignored
+  `Retry-After` unless the caller passed a `failure_callback` of their own, so the
+  one entry point the docs recommend for polite retries was the one that re-sent a
+  throttled request at the worst moment — Microsoft's first instruction is *wait the
+  interval named in the header; do not retry immediately*. The transport paths
+  (`execute_query_retry_parallel`, the async sibling) already honoured it, which made
+  the same library answer two ways. The default `on_failure` policy is now the
+  server's `Retry-After` (`runtime.retry.retry_after_policy`), falling back to the
+  backoff only when the response names no interval, and `max_delay` bounds *any*
+  delay rather than just the exponential one — so a caller who passes a ceiling keeps
+  it even when the service asks for an hour, and a caller who passes none waits as
+  long as the service asked. Pinned offline: `Retry-After: 7` sleeps exactly 7 s
+  before the second attempt, and `max_delay=30` turns a `Retry-After: 600` into 30 s.
+
 **SharePoint (client)**
 
 - **A query bound to a subweb addresses the subweb.** `ClientQuery.url` pasted the
 
@@ -170,25 +170,26 @@ def execute_query_retry(
         are retried. Permanent failures (e.g. HTTP 400/401/403/404) are re-raised
         immediately, and the last exception is re-raised once retries are exhausted.
 
-        Delays between attempts use exponential backoff with jitter; a delay
-        returned by ``failure_callback`` (e.g. the server's ``Retry-After`` via
-        ``retry_after_delay``) overrides the backoff.
+        Delays between attempts use exponential backoff with jitter, and the wait a
+        throttled response asks for (``Retry-After``) overrides the backoff — a
+        ``failure_callback`` replaces that default policy.
 
         Args:
             max_retry: Maximum number of retry attempts
             timeout_secs: Base delay for exponential backoff (seconds)
-            max_delay: Optional cap on the exponential delay (seconds)
-            jitter: Whether to randomize the delay (default True)
+            max_delay: Optional cap on any delay, the server's included (seconds)
+            jitter: Whether to randomize the backoff delay (default True)
             success_callback: Called on successful execution
             failure_callback: Called after each failed attempt; may return a
-                retry delay in seconds to override the backoff
+                retry delay in seconds to override the backoff. Defaults to the
+                server's ``Retry-After`` (:func:`~office365.runtime.retry.retry_after_policy`).
             exceptions: Exception types that trigger retries
             is_retriable: Optional predicate deciding whether a caught exception
                 is retried. Defaults to :func:`~office365.runtime.retry.is_transient_error`;
                 pass :func:`~office365.runtime.retry.retry_on` to also retry
                 otherwise-permanent errors such as a locked file (HTTP 423).
         """
-        from office365.runtime.retry import is_transient_error, retry, should_reset_connections
+        from office365.runtime.retry import is_transient_error, retry, retry_after_policy, should_reset_connections
 
         def _on_failure(_attempt: int, ex: Exception) -> Optional[int]:
             # Drop a poisoned keep-alive socket before retrying a 503/connection
@@ -199,7 +200,10 @@ def _on_failure(_attempt: int, ex: Exception) -> Optional[int]:
             # otherwise the context is left with a stale, un-executed query.
             if _attempt < max_retry and self.current_query is not None:
                 self.add_query(self.current_query)
-            return failure_callback(_attempt, ex) if callable(failure_callback) else None
+            # Microsoft's first instruction for a throttled request: wait the
+            # interval the server named. Without a ``Retry-After`` (or with a
+            # ``failure_callback`` of your own) the backoff decides.
+            return (failure_callback or retry_after_policy)(_attempt, ex)
 
         def _on_success(_) -> None:
             if callable(success_callback) and self.current_query is not None:
@@ -550,23 +554,25 @@ async def execute_query_async_retry(
         """Executes pending queries with retry logic, without blocking the loop.
 
         Async counterpart of :meth:`execute_query_retry` — same retry policy
-        (transient-only by default, exponential backoff with jitter), but the
-        delay between attempts uses ``asyncio.sleep``.
+        (transient-only by default, exponential backoff with jitter, the server's
+        ``Retry-After`` ahead of it), but the delay between attempts uses
+        ``asyncio.sleep``.
 
         Args:
             max_retry: Maximum number of retry attempts
             timeout_secs: Base delay for exponential backoff (seconds)
-            max_delay: Optional cap on the exponential delay (seconds)
-            jitter: Whether to randomize the delay (default True)
+            max_delay: Optional cap on any delay, the server's included (seconds)
+            jitter: Whether to randomize the backoff delay (default True)
             success_callback: Called on successful execution
             failure_callback: Called after each failed attempt; may return a
-                retry delay in seconds to override the backoff
+                retry delay in seconds to override the backoff. Defaults to the
+                server's ``Retry-After`` (:func:`~office365.runtime.retry.retry_after_policy`).
             exceptions: Exception types that trigger retries
             is_retriable: Optional predicate deciding whether a caught exception
                 is retried. Defaults to
                 :func:`~office365.runtime.retry.is_transient_error`.
         """
-        from office365.runtime.retry import is_transient_error, retry_async, should_reset_connections
+        from office365.runtime.retry import is_transient_error, retry_after_policy, retry_async, should_reset_connections
 
         def _on_failure(_attempt: int, ex: Exception) -> Optional[int]:
             # Drop a poisoned keep-alive socket before retrying a 503/connection
@@ -577,7 +583,7 @@ def _on_failure(_attempt: int, ex: Exception) -> Optional[int]:
             # otherwise the context is left with a stale, un-executed query.
             if _attempt < max_retry and self.current_query is not None:
                 self.add_query(self.current_query)
-            return failure_callback(_attempt, ex) if callable(failure_callback) else None
+            return (failure_callback or retry_after_policy)(_attempt, ex)
 
         def _on_success(_) -> None:
             if callable(success_callback) and self.current_query is not None:
 
@@ -128,6 +128,16 @@ def response_retry_after(response: Any) -> Optional[int]:
     return max(0, ceil(delay))
 
 
+def retry_after_policy(_attempt: int, ex: Exception) -> Optional[int]:
+    """The default ``on_failure`` policy: wait for what the server asked of you.
+
+    Signature-compatible with ``on_failure``/``failure_callback`` so a caller can
+    pass it as-is; it exists because :func:`retry_after_delay` reads one argument
+    and the retry loops promise two.
+    """
+    return retry_after_delay(ex)
+
+
 def backoff_delay(attempt: int, base: int, max_delay: Optional[int] = None, jitter: bool = True) -> float:
     """Compute the delay before retry ``attempt``.
 
@@ -152,6 +162,26 @@ def backoff_delay(attempt: int, base: int, max_delay: Optional[int] = None, jitt
     return delay
 
 
+def delay_before_attempt(
+    attempt: int,
+    retry_after: Optional[int],
+    timeout_secs: int,
+    max_delay: Optional[int],
+    jitter: bool,
+) -> float:
+    """Seconds to wait before retry ``attempt``: the server's request, else the backoff.
+
+    ``max_delay`` bounds whichever is chosen, so a caller that caps its retries
+    also caps the wait a server is allowed to ask for — a ``Retry-After`` of an
+    hour is honored by a caller who asked for it and bounded by one who asked
+    for a ceiling.
+    """
+    delay = retry_after if retry_after is not None else backoff_delay(attempt, timeout_secs, max_delay, jitter)
+    if max_delay is not None:
+        delay = min(delay, max_delay)
+    return delay
+
+
 def _run_with_retry(
     func: Callable[[], Any],
     *,
@@ -175,10 +205,8 @@ def _run_with_retry(
             if not callable(is_retriable) or not is_retriable(e):
                 raise
             last_ex = e
-            retry_after: Optional[int] = None
-            if callable(on_failure):
-                retry_after = on_failure(attempt, e)
-            delay = retry_after if retry_after is not None else backoff_delay(attempt, timeout_secs, max_delay, jitter)
+            retry_after = on_failure(attempt, e) if callable(on_failure) else retry_after_policy(attempt, e)
+            delay = delay_before_attempt(attempt, retry_after, timeout_secs, max_delay, jitter)
             sleep(delay)
     assert last_ex is not None
     raise last_ex
@@ -198,10 +226,11 @@ def retry(
     """Run ``func`` with retries — or, called without ``func``, return a decorator.
 
     Permanent failures re-raise immediately; the last exception is re-raised
-    once retries are exhausted. The delay between attempts is exponential with
-    jitter (:func:`backoff_delay`); when ``on_failure`` returns a delay (e.g.
-    the server's ``Retry-After`` via :func:`retry_after_delay`) that value
-    overrides the backoff.
+    once retries are exhausted. The delay between attempts is the one the server
+    named (``Retry-After``, via :func:`retry_after_policy`) and falls back to
+    exponential backoff with jitter (:func:`backoff_delay`) when it named none;
+    ``on_failure`` replaces that policy, and ``max_delay`` bounds whichever delay
+    results.
 
     Two forms::
 
@@ -215,12 +244,13 @@ def do_request(): ...
         func: Callable to execute. Omit to get a decorator.
         max_retry: Maximum number of retry attempts
         timeout_secs: Base delay for exponential backoff (seconds)
-        max_delay: Optional cap for the exponential delay (seconds)
-        jitter: Whether to randomize the delay (default True)
+        max_delay: Optional cap for any delay, the server's included (seconds)
+        jitter: Whether to randomize the backoff delay (default True)
         exceptions: Exception types that are candidates for retry
         is_retriable: Classifier deciding whether a caught exception is retried
         on_failure: Called after each failed attempt with ``(attempt, ex)``;
-            may return a retry delay (seconds) to override the backoff
+            may return a retry delay (seconds) to override the policy. Defaults
+            to :func:`retry_after_policy` — the server's ``Retry-After``
         on_success: Called with ``func()`` result on success
     """
     options = {
@@ -261,20 +291,21 @@ async def retry_async(
     """Run an awaitable ``func`` with retries, without blocking the event loop.
 
     Async counterpart of :func:`retry`: identical retry/backoff semantics
-    (transient-only by default, exponential backoff with jitter, ``Retry-After``
-    override), but the wait between attempts uses ``asyncio.sleep`` so
+    (transient-only by default, the server's ``Retry-After`` ahead of exponential
+    backoff with jitter), but the wait between attempts uses ``asyncio.sleep`` so
     concurrently-running tasks keep making progress.
 
     Args:
         func: Awaitable callable to execute.
         max_retry: Maximum number of retry attempts
         timeout_secs: Base delay for exponential backoff (seconds)
-        max_delay: Optional cap for the exponential delay (seconds)
-        jitter: Whether to randomize the delay (default True)
+        max_delay: Optional cap for any delay, the server's included (seconds)
+        jitter: Whether to randomize the backoff delay (default True)
         exceptions: Exception types that are candidates for retry
         is_retriable: Classifier deciding whether a caught exception is retried
         on_failure: Called after each failed attempt with ``(attempt, ex)``;
-            may return a retry delay (seconds) to override the backoff
+            may return a retry delay (seconds) to override the policy. Defaults
+            to :func:`retry_after_policy` — the server's ``Retry-After``
         on_success: Called with ``await func()`` result on success
     """
     last_ex: Exception | None = None
@@ -288,10 +319,8 @@ async def retry_async(
             if not callable(is_retriable) or not is_retriable(e):
                 raise
             last_ex = e
-            retry_after: Optional[int] = None
-            if callable(on_failure):
-                retry_after = on_failure(attempt, e)
-            delay = retry_after if retry_after is not None else backoff_delay(attempt, timeout_secs, max_delay, jitter)
+            retry_after = on_failure(attempt, e) if callable(on_failure) else retry_after_policy(attempt, e)
+            delay = delay_before_attempt(attempt, retry_after, timeout_secs, max_delay, jitter)
             await asyncio.sleep(delay)
     assert last_ex is not None
     raise last_ex
 
@@ -106,6 +106,16 @@ def test_incremental_retry_falls_back_to_exponential_backoff(self):
         self.assertEqual(execute_query.call_count, 2)
         sleep_mock.assert_called_once_with(5)
 
+    def test_retry_after_is_waited_by_default(self):
+        """Microsoft's first instruction for a throttled request: wait what it asked for."""
+        ctx, execute_query = _make_context([_make_exception(429, {"Retry-After": "7"}), None])
+
+        with mock.patch("office365.runtime.retry.sleep") as sleep_mock:
+            ctx.execute_query_retry(max_retry=5, timeout_secs=1, jitter=False)
+
+        self.assertEqual(execute_query.call_count, 2)
+        sleep_mock.assert_called_once_with(7)
+
 
 class TestRetryFunction(unittest.TestCase):
     def test_retries_exhausted_raises_last_error(self):
@@ -128,6 +138,15 @@ def test_invalid_url_is_not_retried(self):
         self.assertEqual(func.call_count, 1)
         sleep_mock.assert_not_called()
 
+    def test_max_delay_bounds_the_wait_the_server_asks_for(self):
+        """A caller who names a ceiling keeps it, whatever ``Retry-After`` says."""
+        func = mock.Mock(side_effect=[_make_exception(429, {"Retry-After": "600"}), None])
+
+        with mock.patch("office365.runtime.retry.sleep") as sleep_mock:
+            retry(func, max_retry=5, max_delay=30)
+
+        sleep_mock.assert_called_once_with(30)
+
 
 class TestTransportErrorClassification(unittest.TestCase):
     def test_connection_and_timeout_are_transient(self):