fairfax / Sign-in errors / AADSTS900432
AADSTS900432: Confidential Client isn't supported in Cross Cloud request
An app that signs in with a secret or certificate (a confidential client) asked for a token across clouds, for example an app registered in commercial Entra ID calling into a GCC High tenant. Microsoft doesn't support confidential clients in cross-cloud requests.
How to fix it
Register the app in the same cloud as the tenant it calls, and request tokens from that cloud's sign-in host.
| Your tenant or subscription | Sign-in host |
|---|---|
| Commercial Microsoft 365 and Azure, and GCC tenants | login.microsoftonline.com |
| GCC High and DoD tenants, and Azure Government | login.microsoftonline.us |
What Microsoft says
“AADSTS900432 | Confidential Client isn't supported in Cross Cloud request.”
Source: Microsoft Entra authentication and authorization error codes, page updated 2026-06-15, checked 2026-10-12.
- “Microsoft Entra ID for US Government | https://login.microsoftonline.us” (National clouds)
Decode it from the command line
pip install fairfax
fairfax explain AADSTS900432 --tenant gcchigh # or paste the whole error messageTo find the commercial sign-in host in your code before it fails, run
fairfax scan src/ --tenant gcchigh --azure government.
Other cross-cloud sign-in errors
- AADSTS50049: NoSuchInstanceForDiscovery
- AADSTS90002: InvalidTenantName
- AADSTS90038: NationalCloudTenantRedirection
- AADSTS90051: InvalidNationalCloudId
- AADSTS700016: UnauthorizedClient_DoesNotMatchRequest
- AADSTS900382: Confidential Client isn't supported in Cross Cloud request
- AADSTS900439: USGClientNotSupportedOnPublicEndpoint
- AADSTS1000104: XCB2BResourceCloudNotAllowedOnIdentityTenant