Check a Microsoft gov-cloud plan before you build it

fairfax is an open source command-line tool and dataset for Microsoft's US government clouds. Give it your tenant type (GCC, GCC High or DoD), your Azure cloud and the features you plan to use, from Azure and Power Platform to Microsoft 365 Copilot, Teams, Purview and Intune. It tells you what Microsoft doesn't offer there, what can't cross between the clouds and what is retiring, and quotes the Microsoft row behind each answer.

The problem

Microsoft's US government clouds are not copies of commercial Microsoft 365 and Azure. GCC, GCC High, DoD and Azure Government each lack features that commercial has, and some pairings of them can't talk to each other at all. Microsoft does publish the gaps, spread across more than a dozen Learn pages and a PDF it republishes every few weeks. Most teams find them halfway through a build, when a connector never shows up or a sign-in fails with a wrong-cloud error.

What it catches

The repository ships a made-up example: a state agency's field inspection app on GCC High and Azure Government.

$ fairfax check examples/field-inspections/plan.yaml
fairfax check: Field inspection app (synthetic example)
tenant GCC High, Azure Government | 10 features | dataset of 633 features, pages checked 2026-10-12

BLOCKED (4)

  defender-for-cloud/ai-services
    Microsoft Defender for AI Services: not available in Azure Government.
    Works in commercial Azure (GA).
    source: Cloud feature availability for US Government customers
            page updated 2026-09-03, checked 2026-10-12
            https://learn.microsoft.com/en-us/azure/security/fundamentals/feature-availability#microsoft-defender-for-cloud
    row:    - Microsoft Defender for AI Services | GA | Not Available
  power-automate/actionable-approval-emails
  power-automate/mobile-ios
  sentinel/connector/teams
  ...

4 blocked, 0 cross-cloud, 0 retiring, 1 note, 6 ok

fairfax check exits 1 when anything is blocked and fairfax scan exits 1 on a wrong-cloud endpoint, so both work as CI gates.

Microsoft 365, with Microsoft's roadmap

Microsoft 365 Copilot, Teams, Exchange Online, SharePoint, OneDrive, Purview, Intune and Defender are covered too. When a feature is missing and Microsoft's public roadmap has an item for it, the finding shows the item and its target month, and says so when that month has passed.

$ fairfax check examples/m365-rollout/plan.yaml
fairfax check: Staff collaboration rollout (synthetic example)
tenant GCC High, no Azure cloud given | 11 features | dataset of 633 features, pages checked 2026-10-12

BLOCKED (7)

  m365-copilot/copilot-analytics
    Microsoft 365 Copilot: Copilot Analytics in Viva Insights: not available in GCC High.
    Works in GCC (available).
    Copilot Analytics in Viva Insights: A limited set of core metrics is currently available in GCC.
    Microsoft 365 roadmap 570428, "Microsoft Viva: Viva Insights and Copilot Analytics in GCC-High":
    In development for GCC High, target 2026-09. That month has passed, so check the roadmap for a
    newer date.
    https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=570428
    source: Microsoft Copilot service description
            page updated 2026-08-21, checked 2026-10-12
            https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/microsoft-365-copilot#feature-availability
    row:    Copilot Analytics in Viva Insights | Yes | Yes12 | Not currently available | Not
            currently available
  ...

7 blocked, 0 cross-cloud, 0 retiring, 1 note, 4 ok

Sign-in errors, decoded

When a commercial sign-in host meets a GCC High or Azure Government tenant, the error is a code like AADSTS900439. fairfax explain takes the code or the whole message and answers with Microsoft's wording, the cause and the right host for your clouds. The sign-in errors pages cover all 9.

$ fairfax explain AADSTS900439 --tenant gcchigh
AADSTS900439  USGClientNotSupportedOnPublicEndpoint
    Your app signed in a GCC High, DoD or Azure Government user through the commercial sign-in host,
    login.microsoftonline.com. Microsoft Entra ID has blocked that since 2020: users in US
    Government tenants must sign in through login.microsoftonline.us.

  Fix
    Point the app's authority at login.microsoftonline.us. If the app is registered in a commercial
    tenant and is meant to serve US Government users, Microsoft says it may need a new app
    registration in the US Government cloud.
    login.microsoftonline.us  for a GCC High tenant

In CI, and for AI coding tools

The GitHub Action, listed on the GitHub Marketplace, runs check and scan, writes the report to the job summary, marks each finding on its line in the pull request, and can upload SARIF to code scanning:

- uses: intikhab49/fairfax@v0.2.2
  with:
    plan: plan.yaml        # optional
    scan: src

fairfax mcp runs a Model Context Protocol server, so Claude Code, VS Code, Cursor and other agents can check a plan, scan code and decode errors with citations instead of guessing:

claude mcp add fairfax -- fairfax mcp

Availability tables

The same dataset, as tables with Microsoft's row, the page link and the dates for every entry:

• Microsoft Sentinel in Azure Government, GCC, GCC High and DoD: 54 features
• Microsoft Defender for Cloud in Azure Government: 24 features
• Azure Machine Learning in Azure Government: 23 features
• Azure OpenAI models in Azure Government: 11 features
• Azure AI Language in Azure Government: 5 features
• Power Platform in GCC, GCC High and DoD: 70 features
• Microsoft 365 Copilot in GCC, GCC High and DoD: 25 features
• Microsoft Teams in GCC, GCC High and DoD: 35 features
• Exchange Online in GCC, GCC High and DoD: 90 features
• SharePoint and OneDrive in GCC, GCC High and DoD: 13 features
• Microsoft Purview in GCC, GCC High and DoD: 230 features
• Microsoft Intune in GCC High and DoD: 35 features
• Defender for Endpoint and Defender XDR in GCC, GCC High and DoD: 18 features
• Azure Government and GCC High endpoints: 57 host mappings

Quick start

pip install fairfax

fairfax facts --grep copilot                       # feature keys and their status per cloud
fairfax check plan.yaml                            # text report; --format md, json or sarif
fairfax scan src/ --tenant gcchigh --azure government
fairfax explain AADSTS900439 --tenant gcchigh      # decode a cross-cloud sign-in error
fairfax verify                                     # re-read Microsoft's pages, confirm every cited row
fairfax verify --archived                          # same check against the Wayback Machine copies
fairfax mcp                                        # MCP server for coding agents

Python 3.10 or newer, MIT licensed, one dependency (PyYAML). A plan is a short YAML file:

name: Field inspection app
tenant: gcchigh        # gcc | gcchigh | dod
azure: government      # commercial | government
features:
  - power-automate/actionable-approval-emails
  - sentinel/connector/teams
  - azure-openai/gpt-4o

How the data stays honest

• Every entry stores the Microsoft page, the section anchor and the row exactly as Microsoft wrote it.
• Statuses were parsed from those rows by a script, not retyped, and the tests re-parse them on every run.
• Each entry carries the page's own updated date and the date fairfax last checked it.
• fairfax verify re-reads all 33 pages and confirms every cited row is still there; a weekly workflow runs it and opens an issue when Microsoft changes or removes one.
• Each cited page has a Wayback Machine snapshot that was checked to hold the cited rows, so a citation outlives its page.
• Where Microsoft's tables don't answer a question, fairfax says so instead of guessing.

FAQ

How do I check whether a Microsoft feature is available in GCC High or Azure Government?

Microsoft publishes availability per cloud across many pages: fairfax cites 31 Microsoft Learn pages, a PDF and the Microsoft 365 roadmap, and collects 633 features from them. Run pip install fairfax, then fairfax facts --grep <name> to see a feature's status in each cloud, or browse the availability tables on this site. Each row links to the Microsoft page it came from.

Is Microsoft 365 Copilot available in GCC High and DoD?

Yes, with gaps. Microsoft's Copilot service description lists 25 features by cloud. Not available today in GCC High: Word, Excel, and PowerPoint Agents, Scheduled Prompts, Edit with Copilot in Word, Excel, PowerPoint, and OneNote, Copilot in Teams (Chat, Channel, Meetings), Copilot in SharePoint, SharePoint agents, Power Platform Connectors, Copilot Analytics in Viva Insights. Not available in DoD: Create, Researcher, Word, Excel, and PowerPoint Agents, Copilot Prompt Gallery, Scheduled Prompts, Edit with Copilot in Word, Excel, PowerPoint, and OneNote, Declarative agents, Agent Builder, Power Platform Connectors, Copilot Analytics in Viva Insights. The Microsoft 365 Copilot table on this site quotes each row.

What does AADSTS900439 USGClientNotSupportedOnPublicEndpoint mean?

Your app signed in a GCC High, DoD or Azure Government user through the commercial sign-in host, login.microsoftonline.com. Microsoft Entra ID has blocked that since 2020: users in US Government tenants must sign in through login.microsoftonline.us. Point the app's authority at login.microsoftonline.us. If the app is registered in a commercial tenant and is meant to serve US Government users, Microsoft says it may need a new app registration in the US Government cloud. fairfax explain decodes it and 8 other cross-cloud sign-in errors from the code or the whole message.

What is the difference between GCC, GCC High and DoD?

They are separate US government clouds for Microsoft 365, and they differ in where users sign in and in which features exist. GCC signs users in through commercial Entra ID (login.microsoftonline.com), while GCC High and DoD sign in through Azure Government (login.microsoftonline.us). GCC support runs on worldwide terms, with no assurances about where support agents are or what citizenship they hold. Of the 70 Power Platform features fairfax tracks, 28 are not available today in GCC, 34 in GCC High and 45 in DoD.

Can a GCC tenant send data to Microsoft Sentinel in Azure Government?

Not through the Microsoft 365 data connectors. Microsoft marks a GCC tenant with a Sentinel workspace in Azure Government as not possible for all 13 connectors fairfax tracks, because a GCC tenant's data lives in commercial Azure. A GCC tenant connects to a workspace in commercial Azure; GCC High and DoD tenants connect to a workspace in Azure Government.

Which Azure OpenAI models are available in Azure Government?

Microsoft's page of Foundry Models sold by Azure in Azure Government (updated 2026-09-01) lists gpt-4.1, gpt-4.1-mini, gpt-4o, gpt-5.1, gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, o3-mini, text-embedding-3-large, text-embedding-3-small, text-embedding-ada-002. Deployment types differ by model and region, and the Azure OpenAI table on this site lists them for each model.

Which endpoints does GCC High use instead of login.microsoftonline.com and graph.microsoft.com?

GCC High uses login.microsoftonline.us for Entra ID sign-in and graph.microsoft.us for Microsoft Graph. DoD uses dod-graph.microsoft.us for Graph. A GCC tenant keeps login.microsoftonline.com and graph.microsoft.com. The endpoints page lists all 57 mappings, and fairfax scan finds commercial hosts in your code.

Does fairfax need access to my tenant or Azure subscription?

No. It reads a plan file and your source code on your own machine and never connects to Microsoft 365 or Azure. The data ships inside the package.

How current is the data?

Every entry stores the Microsoft page's own updated date and the date fairfax last checked it. All 33 cited pages were checked on 2026-10-12. Every week fairfax verify re-reads each page and confirms that every cited row is still there word for word; when Microsoft changes one, an issue opens with the old and new text.

What if Microsoft deletes or moves a page fairfax cites?

fairfax keeps working: every row is stored word for word inside the package, with its page and dates. 33 of the 33 cited pages also have a Wayback Machine snapshot that was checked to contain the same rows, and every finding links to it. If a page returns 404 or 410, the weekly fairfax verify fails and opens an issue that points to the snapshot. fairfax verify --archived re-checks every cited row against the snapshots.

Can AI coding assistants use fairfax?

Yes. fairfax mcp runs a Model Context Protocol server with four read-only tools: find feature keys, check a plan, scan code for wrong-cloud hosts and explain sign-in errors. Add it to Claude Code with claude mcp add fairfax -- fairfax mcp, or to any MCP client as the command fairfax mcp.

Is fairfax made by Microsoft, and is it compliance advice?

No to both. fairfax is an independent open source project under the MIT license. It tells you whether Microsoft offers a feature in a cloud, quoting Microsoft's own rows. It doesn't tell you whether your use of a feature meets FedRAMP, ITAR or CMMC.