Use MSAL in a national cloud environment

National clouds, also known as Sovereign clouds, are physically isolated instances of Azure. These regions of Azure help make sure that data residency, sovereignty, and compliance requirements are honored within geographical boundaries.

In addition to the Microsoft worldwide cloud, the Microsoft Authentication Library (MSAL) enables application developers in national clouds to acquire tokens in order to authenticate and call secured web APIs. These web APIs can be Microsoft Graph or other Microsoft APIs.

Including the global Azure cloud, Microsoft Entra ID is deployed in the following national clouds: 

This guide demonstrates how to sign in to work and school accounts, get an access token, and call the Microsoft Graph API in the Azure Government cloud environment.

Azure Germany (Microsoft Cloud Deutschland)


Azure Germany (Microsoft Cloud Deutschland) will be closed on October 29, 2021. Services and applications you choose not to migrate to a region in global Azure before that date will become inaccessible.

If you haven't migrated your application from Azure Germany, follow Microsoft Entra information for the migration from Azure Germany to get started.


Before you start, make sure that you meet these prerequisites.

Choose the appropriate identities

Azure Government applications can use Microsoft Entra Government identities and Microsoft Entra Public identities to authenticate users. Because you can use any of these identities, decide which authority endpoint you should choose for your scenario:

  • Microsoft Entra Public: Commonly used if your organization already has a Microsoft Entra Public tenant to support Microsoft 365 (Public or GCC) or another application.
  • Microsoft Entra Government: Commonly used if your organization already has a Microsoft Entra Government tenant to support Office 365 (GCC High or DoD) or is creating a new tenant in Microsoft Entra Government.

After you decide, a special consideration is where you perform your app registration. If you choose Microsoft Entra Public identities for your Azure Government application, you must register the application in your Microsoft Entra Public tenant.

Get an Azure Government subscription

To get an Azure Government subscription, see Managing and connecting to your subscription in Azure Government.

If you don't have an Azure Government subscription, create a free account before you begin.

For details about using a national cloud with a particular programming language, choose the tab matching your language:

You can use MSAL.NET to sign in users, acquire tokens, and call the Microsoft Graph API in national clouds.

The following tutorials demonstrate how to build a .NET Core 2.2 MVC Web app. The app uses OpenID Connect to sign in users with a work and school account in an organization that belongs to a national cloud.

Next steps

See National cloud authentication endpoints for a list of the Azure portal URLs and token endpoints for each cloud.

National cloud documentation: