fairfax / Sign-in errors / AADSTS90038
AADSTS90038: NationalCloudTenantRedirection
The tenant you're signing in to belongs to a different national cloud from the sign-in host you used, and the two clouds don't federate. Typical cause: a GCC High, DoD or Azure Government tenant reached through login.microsoftonline.com, or the other way round.
How to fix it
Send the request to the sign-in host of the tenant's own cloud.
| Your tenant or subscription | Sign-in host |
|---|---|
| Commercial Microsoft 365 and Azure, and GCC tenants | login.microsoftonline.com |
| GCC High and DoD tenants, and Azure Government | login.microsoftonline.us |
What Microsoft says
“AADSTS90038 | NationalCloudTenantRedirection - The specified tenant 'Y' belongs to the National Cloud 'X'. Current cloud instance 'Z' does not federate with X. A cloud redirect error is returned.”
Source: Microsoft Entra authentication and authorization error codes, page updated 2026-06-15, checked 2026-10-12.
- “Microsoft Entra ID for US Government | https://login.microsoftonline.us” (National clouds)
Decode it from the command line
pip install fairfax
fairfax explain AADSTS90038 --tenant gcchigh # or paste the whole error messageTo find the commercial sign-in host in your code before it fails, run
fairfax scan src/ --tenant gcchigh --azure government.
Other cross-cloud sign-in errors
- AADSTS50049: NoSuchInstanceForDiscovery
- AADSTS90002: InvalidTenantName
- AADSTS90051: InvalidNationalCloudId
- AADSTS700016: UnauthorizedClient_DoesNotMatchRequest
- AADSTS900382: Confidential Client isn't supported in Cross Cloud request
- AADSTS900432: Confidential Client isn't supported in Cross Cloud request
- AADSTS900439: USGClientNotSupportedOnPublicEndpoint
- AADSTS1000104: XCB2BResourceCloudNotAllowedOnIdentityTenant