fairfax / Sign-in errors / AADSTS900382
AADSTS900382: Confidential Client isn't supported in Cross Cloud request
Same message as AADSTS900432: a confidential client (an app with a secret or certificate) asked for a token across clouds, and Microsoft doesn't support that.
How to fix it
Register the app in the same cloud as the tenant it calls, and request tokens from that cloud's sign-in host.
| Your tenant or subscription | Sign-in host |
|---|---|
| Commercial Microsoft 365 and Azure, and GCC tenants | login.microsoftonline.com |
| GCC High and DoD tenants, and Azure Government | login.microsoftonline.us |
What Microsoft says
“AADSTS900382 | Confidential Client isn't supported in Cross Cloud request.”
Source: Microsoft Entra authentication and authorization error codes, page updated 2026-06-15, checked 2026-10-12.
- “Microsoft Entra ID for US Government | https://login.microsoftonline.us” (National clouds)
Decode it from the command line
pip install fairfax
fairfax explain AADSTS900382 --tenant gcchigh # or paste the whole error messageTo find the commercial sign-in host in your code before it fails, run
fairfax scan src/ --tenant gcchigh --azure government.
Other cross-cloud sign-in errors
- AADSTS50049: NoSuchInstanceForDiscovery
- AADSTS90002: InvalidTenantName
- AADSTS90038: NationalCloudTenantRedirection
- AADSTS90051: InvalidNationalCloudId
- AADSTS700016: UnauthorizedClient_DoesNotMatchRequest
- AADSTS900432: Confidential Client isn't supported in Cross Cloud request
- AADSTS900439: USGClientNotSupportedOnPublicEndpoint
- AADSTS1000104: XCB2BResourceCloudNotAllowedOnIdentityTenant