fairfax / Sign-in errors
Sign-in errors from mixing Microsoft clouds
An app built for commercial Microsoft 365 or Azure signs users in through
login.microsoftonline.com. GCC High, DoD and Azure Government tenants sign in through
login.microsoftonline.us, and the clouds don't federate, so a mixed-up host or app registration fails
with one of these errors. Each page quotes Microsoft and says what to change.
| Code | Name | What it means |
|---|---|---|
| AADSTS50049 | NoSuchInstanceForDiscovery | The authority your app was given isn't a known Microsoft Entra instance, often a typo in the sign-in host or a host from the wrong cloud. |
| AADSTS90002 | InvalidTenantName | Microsoft Entra ID can't find the tenant on the host you asked. |
| AADSTS90038 | NationalCloudTenantRedirection | The tenant you're signing in to belongs to a different national cloud from the sign-in host you used, and the two clouds don't federate. |
| AADSTS90051 | InvalidNationalCloudId | The national cloud identifier in the request isn't valid, for example a misspelled or mixed-up cloud name in your authentication library's settings. |
| AADSTS700016 | UnauthorizedClient_DoesNotMatchRequest | The app wasn't found in the tenant. |
| AADSTS900382 | Confidential Client isn't supported in Cross Cloud request | Same message as AADSTS900432: a confidential client (an app with a secret or certificate) asked for a token across clouds, and Microsoft doesn't support that. |
| AADSTS900432 | Confidential Client isn't supported in Cross Cloud request | An app that signs in with a secret or certificate (a confidential client) asked for a token across clouds, for example an app registered in commercial Entra ID calling into a GCC High tenant. |
| AADSTS900439 | USGClientNotSupportedOnPublicEndpoint | Your app signed in a GCC High, DoD or Azure Government user through the commercial sign-in host, login.microsoftonline.com. |
| AADSTS1000104 | XCB2BResourceCloudNotAllowedOnIdentityTenant | A user from one cloud tried to reach a resource in another cloud (cross-cloud B2B), and the tenant's settings don't allow that pairing of clouds. |
| Your tenant or subscription | Sign-in host |
|---|---|
| Commercial Microsoft 365 and Azure, and GCC tenants | login.microsoftonline.com |
| GCC High and DoD tenants, and Azure Government | login.microsoftonline.us |
fairfax explain "AADSTS900439: ..." # paste the whole message; add --tenant gcchigh for the right host