AADSTS900439: Azure Government app signed in on the public endpoint (fix)

What does AADSTS900439 mean?

Microsoft’s error code reference doesn’t list AADSTS900439 (checked 30 October 2026).

Microsoft documents it in a troubleshooting article, which names it USGClientNotSupportedOnPublicEndpoint:

When trying to sign in to an application registered in the Azure Government cloud using a public endpoint, the sign-in fails, and you receive the AADSTS900439 (USGClientNotSupportedOnPublicEndpoint) error.

The article gives the code and name but not the full message text, and we found no user report that quotes it in full.

Microsoft’s cause:

Microsoft Entra authority for Azure Government has been updated from https://login-us.microsoftonline.com to https://login.microsoftonline.us. This change also applies to Microsoft 365 GCC High and Microsoft 365 DoD environments, which Microsoft Entra authority for Azure Government also services. Microsoft Entra ID enforces the correct endpoint for sign-in operations.

The article adds: “You can no longer sign in to an application registered in the Azure Government cloud using the public endpoint https://login-us.microsoftonline.com.” The clouds are separate. Microsoft’s national clouds page: “Each cloud instance is separate from the others and has its own environment and endpoints.” It lists https://login.microsoftonline.us for US Government and https://login.microsoftonline.com for the global service.

Is it an attack?

No. It is a configuration error in the app or its SDK settings.

Pattern	Likely meaning
An older app or script for a GCC High, DoD or Azure Government tenant fails	It still uses login-us.microsoftonline.com.
A tool that works for commercial tenants fails for a government tenant	The tool is hard-coded to a public-cloud endpoint. Our interpretation; the article only names login-us.microsoftonline.com.
A third-party product fails for your government tenant only	The vendor has no setting for the US Government cloud, or it isn’t set.

How do I find it in my logs (KQL)?

Microsoft doesn’t document where 900439 is logged. Our reading: the request reaches a public-cloud endpoint, not your Azure Government tenant, so a row in your tenant’s logs is unlikely. Check anyway; this is expected to return nothing:

union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs, AADServicePrincipalSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "900439"
| summarize Rows = count() by SourceTable

How do I fix AADSTS900439?

For the user: you can’t fix this yourself. Tell whoever runs the app that it uses the wrong sign-in endpoint for a US Government tenant.

For developers: use the Azure Government endpoints. Microsoft’s article lists:

Name	Azure Government endpoint
Portal	https://portal.azure.us
Microsoft Graph API	https://graph.microsoft.us
Active Directory endpoint and authority	https://login.microsoftonline.us

Change the authority, and the Graph base URL too if the app calls Graph. Microsoft’s national clouds page: “use the endpoints for the cloud instance where you’ll deploy the application.”

For admins:

1. Search app configs, scripts and connection settings for login-us.microsoftonline.com and replace it with https://login.microsoftonline.us.
2. For third-party products, tell the vendor your tenant is in the US Government cloud (GCC High, DoD or Azure Government) and ask for their setting for it.