fairfax / Sign-in errors / AADSTS1000104

AADSTS1000104: XCB2BResourceCloudNotAllowedOnIdentityTenant

A user from one cloud tried to reach a resource in another cloud (cross-cloud B2B), and the tenant's settings don't allow that pairing of clouds.

How to fix it

Either allow B2B collaboration with the other Microsoft cloud in the tenant's cross-tenant access settings, or use an account from the resource's own cloud.

Your tenant or subscription	Sign-in host
Commercial Microsoft 365 and Azure, and GCC tenants	`login.microsoftonline.com`
GCC High and DoD tenants, and Azure Government	`login.microsoftonline.us`

Note: Microsoft's row for this code doesn't mention clouds. The cause above is the common one in US government setups, so check it against yours.

What Microsoft says

“AADSTS1000104 | XCB2BResourceCloudNotAllowedOnIdentityTenant - Resource cloud {resourceCloud} isn't allowed on identity tenant {identityTenant}. {resourceCloud} - cloud instance which owns the resource. {identityTenant} - is the tenant where signing-in identity is originated from.”

Source: Microsoft Entra authentication and authorization error codes, page updated 2026-06-15, checked 2026-10-12.

Decode it from the command line

pip install fairfax
fairfax explain AADSTS1000104 --tenant gcchigh      # or paste the whole error message

To find the commercial sign-in host in your code before it fails, run fairfax scan src/ --tenant gcchigh --azure government.

Other cross-cloud sign-in errors

AADSTS50049: NoSuchInstanceForDiscovery
AADSTS90002: InvalidTenantName
AADSTS90038: NationalCloudTenantRedirection
AADSTS90051: InvalidNationalCloudId
AADSTS700016: UnauthorizedClient_DoesNotMatchRequest
AADSTS900382: Confidential Client isn't supported in Cross Cloud request
AADSTS900432: Confidential Client isn't supported in Cross Cloud request
AADSTS900439: USGClientNotSupportedOnPublicEndpoint