{
  "schemaVersion": "1.0",
  "code": "900439",
  "name": "USGClientNotSupportedOnPublicEndpoint",
  "title": "AADSTS900439: Azure Government app signed in on the public endpoint (fix)",
  "url": "https://brambrinkmeier.com/entra/aadsts/900439/",
  "alternates": {
    "markdown": "https://brambrinkmeier.com/entra/aadsts/900439.md",
    "json": "https://brambrinkmeier.com/api/aadsts/900439.json",
    "html": "https://brambrinkmeier.com/entra/aadsts/900439/"
  },
  "description": "AADSTS900439: an Azure Government app used a public-cloud sign-in endpoint. Not in Microsoft's reference. Use login.microsoftonline.us instead.",
  "summary": "AADSTS900439 means an app registered in the Azure Government cloud tried to sign in through a public-cloud endpoint. Microsoft's error reference doesn't list it; a Microsoft troubleshooting article does. It also covers Microsoft 365 GCC High and DoD. It is a configuration error with no attack value. Point the app at login.microsoftonline.us.",
  "inMicrosoftReference": false,
  "unlistedChecked": "2026-10-30",
  "meaningText": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS900439 (checked 30 October 2026).\n\nMicrosoft documents it in a [troubleshooting article](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-aadsts900439-usgclientnotsupportedonpublicendpoint), which names it **USGClientNotSupportedOnPublicEndpoint**:\n\n> When trying to sign in to an application registered in the Azure Government cloud using a public endpoint, the sign-in fails, and you receive the AADSTS900439 (USGClientNotSupportedOnPublicEndpoint) error.\n\nThe article gives the code and name but not the full message text, and we found no user report that quotes it in full.\n\nMicrosoft's cause:\n\n> Microsoft Entra authority for Azure Government has been updated from `https://login-us.microsoftonline.com` to `https://login.microsoftonline.us`. This change also applies to Microsoft 365 GCC High and Microsoft 365 DoD environments, which Microsoft Entra authority for Azure Government also services. Microsoft Entra ID enforces the correct endpoint for sign-in operations.\n\nThe article adds: *\"You can no longer sign in to an application registered in the Azure Government cloud using the public endpoint `https://login-us.microsoftonline.com`.\"* The clouds are separate. Microsoft's national clouds page: *\"Each cloud instance is separate from the others and has its own environment and endpoints.\"* It lists `https://login.microsoftonline.us` for US Government and `https://login.microsoftonline.com` for the global service.",
  "sections": [
    {
      "heading": "What does AADSTS900439 mean?",
      "text": "Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS900439 (checked 30 October 2026).\n\nMicrosoft documents it in a [troubleshooting article](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-aadsts900439-usgclientnotsupportedonpublicendpoint), which names it **USGClientNotSupportedOnPublicEndpoint**:\n\n> When trying to sign in to an application registered in the Azure Government cloud using a public endpoint, the sign-in fails, and you receive the AADSTS900439 (USGClientNotSupportedOnPublicEndpoint) error.\n\nThe article gives the code and name but not the full message text, and we found no user report that quotes it in full.\n\nMicrosoft's cause:\n\n> Microsoft Entra authority for Azure Government has been updated from `https://login-us.microsoftonline.com` to `https://login.microsoftonline.us`. This change also applies to Microsoft 365 GCC High and Microsoft 365 DoD environments, which Microsoft Entra authority for Azure Government also services. Microsoft Entra ID enforces the correct endpoint for sign-in operations.\n\nThe article adds: *\"You can no longer sign in to an application registered in the Azure Government cloud using the public endpoint `https://login-us.microsoftonline.com`.\"* The clouds are separate. Microsoft's national clouds page: *\"Each cloud instance is separate from the others and has its own environment and endpoints.\"* It lists `https://login.microsoftonline.us` for US Government and `https://login.microsoftonline.com` for the global service."
    },
    {
      "heading": "Is it an attack?",
      "text": "No. It is a configuration error in the app or its SDK settings.\n\n| Pattern | Likely meaning |\n|---|---|\n| An older app or script for a GCC High, DoD or Azure Government tenant fails | It still uses `login-us.microsoftonline.com`. |\n| A tool that works for commercial tenants fails for a government tenant | The tool is hard-coded to a public-cloud endpoint. Our interpretation; the article only names `login-us.microsoftonline.com`. |\n| A third-party product fails for your government tenant only | The vendor has no setting for the US Government cloud, or it isn't set. |"
    },
    {
      "heading": "How do I find it in my logs (KQL)?",
      "text": "Microsoft doesn't document where 900439 is logged. Our reading: the request reaches a public-cloud endpoint, not your Azure Government tenant, so a row in your tenant's logs is unlikely. Check anyway; this is expected to return nothing:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"900439\"\n| summarize Rows = count() by SourceTable\n```"
    },
    {
      "heading": "How do I fix AADSTS900439?",
      "text": "**For the user:** you can't fix this yourself. Tell whoever runs the app that it uses the wrong sign-in endpoint for a US Government tenant.\n\n**For developers:** use the Azure Government endpoints. Microsoft's article lists:\n\n| Name | Azure Government endpoint |\n|---|---|\n| Portal | `https://portal.azure.us` |\n| Microsoft Graph API | `https://graph.microsoft.us` |\n| Active Directory endpoint and authority | `https://login.microsoftonline.us` |\n\nChange the authority, and the Graph base URL too if the app calls Graph. Microsoft's national clouds page: *\"use the endpoints for the cloud instance where you'll deploy the application.\"*\n\n**For admins:**\n1. Search app configs, scripts and connection settings for `login-us.microsoftonline.com` and replace it with `https://login.microsoftonline.us`.\n2. For third-party products, tell the vendor your tenant is in the US Government cloud (GCC High, DoD or Azure Government) and ask for their setting for it."
    }
  ],
  "microsoftWording": {
    "text": "When trying to sign in to an application registered in the Azure Government cloud using a public endpoint, the sign-in fails, and you receive the AADSTS900439 (USGClientNotSupportedOnPublicEndpoint) error.",
    "source": "Quoted on the page from the lab or from user reports; the code is not in Microsoft's error code reference",
    "sourceUrl": null
  },
  "securityReading": {
    "category": {
      "id": "app-config",
      "label": "App configuration"
    },
    "kind": {
      "id": "config",
      "label": "Configuration error"
    },
    "attackSignal": {
      "level": "low",
      "label": "Low: usually configuration or user error"
    },
    "mitre": [],
    "tables": [],
    "isItAnAttack": "No. It is a configuration error in the app or its SDK settings.\n\n| Pattern | Likely meaning |\n|---|---|\n| An older app or script for a GCC High, DoD or Azure Government tenant fails | It still uses `login-us.microsoftonline.com`. |\n| A tool that works for commercial tenants fails for a government tenant | The tool is hard-coded to a public-cloud endpoint. Our interpretation; the article only names `login-us.microsoftonline.com`. |\n| A third-party product fails for your government tenant only | The vendor has no setting for the US Government cloud, or it isn't set. |",
    "conditionalAccess": null
  },
  "kql": [
    {
      "title": null,
      "leadIn": "Microsoft doesn't document where 900439 is logged. Our reading: the request reaches a public-cloud endpoint, not your Azure Government tenant, so a row in your tenant's logs is unlikely. Check anyway; this is expected to return nothing:",
      "query": "union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"900439\"\n| summarize Rows = count() by SourceTable"
    }
  ],
  "kqlSectionText": "Microsoft doesn't document where 900439 is logged. Our reading: the request reaches a public-cloud endpoint, not your Azure Government tenant, so a row in your tenant's logs is unlikely. Check anyway; this is expected to return nothing:\n\n```kusto\nunion withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs\n| where TimeGenerated > ago(30d)\n| where ResultType == \"900439\"\n| summarize Rows = count() by SourceTable\n```",
  "fix": {
    "short": "Developer or admin: change the authority from `login-us.microsoftonline.com` to `https://login.microsoftonline.us`, and use `https://graph.microsoft.us` for Graph. Third-party product: ask the vendor for its US Government cloud setting. User: tell whoever runs the app; you can't fix this yourself.",
    "steps": "**For the user:** you can't fix this yourself. Tell whoever runs the app that it uses the wrong sign-in endpoint for a US Government tenant.\n\n**For developers:** use the Azure Government endpoints. Microsoft's article lists:\n\n| Name | Azure Government endpoint |\n|---|---|\n| Portal | `https://portal.azure.us` |\n| Microsoft Graph API | `https://graph.microsoft.us` |\n| Active Directory endpoint and authority | `https://login.microsoftonline.us` |\n\nChange the authority, and the Graph base URL too if the app calls Graph. Microsoft's national clouds page: *\"use the endpoints for the cloud instance where you'll deploy the application.\"*\n\n**For admins:**\n1. Search app configs, scripts and connection settings for `login-us.microsoftonline.com` and replace it with `https://login.microsoftonline.us`.\n2. For third-party products, tell the vendor your tenant is in the US Government cloud (GCC High, DoD or Azure Government) and ask for their setting for it."
  },
  "labReproduced": null,
  "labSectionText": null,
  "labRuns": [],
  "verification": "documentation",
  "related": [
    "90002",
    "700016"
  ],
  "coveredBy": [],
  "sources": [
    {
      "title": "Microsoft Entra authentication and authorization error codes",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes"
    },
    {
      "title": "Error AADSTS900439 - USGClientNotSupportedOnPublicEndpoint",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-aadsts900439-usgclientnotsupportedonpublicendpoint"
    },
    {
      "title": "National clouds (Microsoft identity platform)",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud"
    }
  ],
  "published": "2026-10-30",
  "lastUpdated": "2026-10-30",
  "lastVerified": null,
  "license": "CC BY 4.0",
  "licenseUrl": "https://creativecommons.org/licenses/by/4.0/",
  "licenseNote": "CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.",
  "attribution": "Bram Brinkmeier, \"AADSTS900439: Azure Government app signed in on the public endpoint (fix)\", https://brambrinkmeier.com/entra/aadsts/900439/ (CC BY 4.0)",
  "microsoftErrorLookup": "https://login.microsoftonline.com/error?code=900439"
}