fairfax / Endpoints

Azure Government and GCC High endpoints

Code copied from commercial samples calls commercial hosts such as login.microsoftonline.com and graph.microsoft.com. These are the 57 mappings from Microsoft's endpoint tables that fairfax scan uses to find them and name the right host for your clouds.

Which sign-in cloud your tenant uses

• Office 365 GCC signs users in through commercial Entra ID: login.microsoftonline.com, graph.microsoft.com and portal.azure.com, the same endpoints as worldwide Microsoft 365.
• GCC High and DoD sign users in through Entra ID in Azure Government: login.microsoftonline.us, with graph.microsoft.us (GCC High) or dod-graph.microsoft.us (DoD).

So a GCC tenant keeps the worldwide Entra ID and Graph hosts, while its Power Platform and Power BI hosts are government ones. If the same project also has an Azure Government subscription, a sign-in host can be right for one call and wrong for the next, which is why fairfax scan marks those lines CHECK.

Microsoft Entra ID and the Azure portal

Microsoft 365, Power Platform and Power BI by tenant

Azure services: commercial and Azure Government

Scan your code

pip install fairfax
fairfax scan src/ --tenant gcchigh --azure government

It exits 1 on a wrong-cloud host, so it works as a CI gate. Add fairfax: ignore in a comment to skip a line.