fairfax / Sign-in errors / AADSTS900439

AADSTS900439: USGClientNotSupportedOnPublicEndpoint

Your app signed in a GCC High, DoD or Azure Government user through the commercial sign-in host, login.microsoftonline.com. Microsoft Entra ID has blocked that since 2020: users in US Government tenants must sign in through login.microsoftonline.us.

How to fix it

Point the app's authority at login.microsoftonline.us. If the app is registered in a commercial tenant and is meant to serve US Government users, Microsoft says it may need a new app registration in the US Government cloud.

What Microsoft says

“Impacted apps will begin seeing an error AADSTS900439 - USGClientNotSupportedOnPublicEndpoint. This error indicates that the app is attempting to sign in a US Government user on the public cloud endpoint.”

Source: What's new for authentication?, page updated 2026-08-26, checked 2026-10-12.

• “If you own an application within a US Government tenant, you must update your application to sign users in on the .us endpoint.” (What's new for authentication?)
• “This may require creating a new app registration in the US Government cloud.” (What's new for authentication?)
• “Microsoft Entra ID for US Government | https://login.microsoftonline.us” (National clouds)

Decode it from the command line

pip install fairfax
fairfax explain AADSTS900439 --tenant gcchigh      # or paste the whole error message

To find the commercial sign-in host in your code before it fails, run fairfax scan src/ --tenant gcchigh --azure government.

Other cross-cloud sign-in errors

• AADSTS50049: NoSuchInstanceForDiscovery
• AADSTS90002: InvalidTenantName
• AADSTS90038: NationalCloudTenantRedirection
• AADSTS90051: InvalidNationalCloudId
• AADSTS700016: UnauthorizedClient_DoesNotMatchRequest
• AADSTS900382: Confidential Client isn't supported in Cross Cloud request
• AADSTS900432: Confidential Client isn't supported in Cross Cloud request
• AADSTS1000104: XCB2BResourceCloudNotAllowedOnIdentityTenant