I'm exploring MessageTrace report API : https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace , I can see that, to generate OAuth Token I need to make a GET call to: https://login.windows.net/<tenant-id>/oauth2/token . Does login.windows.net base URL/domain available worldwide including GCC or it needs separate authentication/custom domain for GCC?

Hi, @Tanmoy Satpati When using Azure AD in a public (commercial) cloud scenario, legacy endpoints like login.windows.net (and its more current equivalent, login.microsoftonline.com) are globally available for authenticating users. However, government clouds (such as the U.S. Government Community Cloud [GCC]) are isolated from the public cloud and have their own dedicated endpoints. For GCC (and other sovereign or government clouds), you typically must use the service-specific endpoints. For example, for Azure Government the endpoints are in the login.microsoftonline.us domain rather than login.windows.net or login.microsoftonline.com. This separation helps ensure compliance with regional and governmental regulations. So if you’re targeting GCC, you’ll need to update your authentication configuration to use the correct endpoint for that environment rather than relying on login.windows.net. If the answer is helpful, please click " Accept Answer " and kindly upvote it. If you have extra questions about this answer, please click " Comment ".

Need information on Microsoft Message Trace GCC Support to request OAuth Token

Accepted answer

Xintao Qiao-MSFT 6,270 Reputation points Microsoft Vendor

2025-02-06T02:44:33.6766667+00:00

Hi, @Tanmoy Satpati

When using Azure AD in a public (commercial) cloud scenario, legacy endpoints like login.windows.net (and its more current equivalent, login.microsoftonline.com) are globally available for authenticating users. However, government clouds (such as the U.S. Government Community Cloud [GCC]) are isolated from the public cloud and have their own dedicated endpoints.

For GCC (and other sovereign or government clouds), you typically must use the service-specific endpoints. For example, for Azure Government the endpoints are in the login.microsoftonline.us domain rather than login.windows.net or login.microsoftonline.com. This separation helps ensure compliance with regional and governmental regulations.

So if you’re targeting GCC, you’ll need to update your authentication configuration to use the correct endpoint for that environment rather than relying on login.windows.net.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Please sign in to rate this answer.

1 person found this answer helpful.
Tanmoy Satpati 20 Reputation points

2025-02-06T12:54:09.3766667+00:00

Thanks for responding. I have few queries, as we are using reporting web service API https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace, the legacy endpoint which you mentioned above are also available for generating OAuth token for message trace reporting API? Also, apart from the domains mentioned above can you please redirect me to the documentation which contains list of all supported domains for GCC, as I couldn't find any concrete information regarding this. To add here, we are working on SIEM integration for this API, hence needed the information.

Xintao Qiao-MSFT 6,270 Reputation points Microsoft Vendor

2025-02-07T09:51:42.3833333+00:00

Hi, @Tanmoy Satpati

In the public (commercial) cloud, many of the older documentation examples referenced endpoint nodes such as login.windows.net for token issuance. On the backend, these endpoint nodes typically map to the same global authentication service now more commonly known as login.microsoftonline.com. In many cases, if you are targeting a public Office 365 tenant, the “legacy” endpoint nodes are still valid. However, Microsoft's current guidance is to use a newer endpoint node (e.g. login.microsoftonline.com).

For GCC tenants, the situation is different. GCC tenants have their own dedicated endpoint nodes that are independent of the public cloud. This means that you can't just use the generic (or older) login.windows.net endpoint when generating OAuth tokens for GCC tenants, including when calling the Email Tracking Report API.

In short, while older endpoints may continue to work for public tenants, for GCC you must use government-specific endpoints to get OAuth tokens that are valid for accessing the reporting API.

As far as I know, there is no documentation that includes a list of all supported domains for GCC, but you can refer to these documents.

Microsoft Entra authentication & national clouds - Microsoft identity platform | Microsoft Learn

Microsoft 365 U.S. Government GCC High endpoints - Microsoft 365 Enterprise | Microsoft Learn

Microsoft 365 URLs and IP address ranges - Microsoft 365 Enterprise | Microsoft Learn

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Tanmoy Satpati 20 Reputation points

2025-02-10T10:13:42.2766667+00:00

Hi @Xintao Qiao-MSFT , thank you for sharing documentation and we have gone through it. Can you kindly confirm if the domains mentioned in below URLs will work for reporting API:
https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud

Also, it would be great if you can confirm which authentication endpoint for china cloud can be used as in both the URLs it is different.

Xintao Qiao-MSFT 6,270 Reputation points Microsoft Vendor

2025-02-11T08:53:51.92+00:00

Hi, @Tanmoy Satpati

The domains referenced in the official documentation, including the domains used for authentication, are indeed the domains that you will be using with the reporting API in these environments.

For China Cloud, the recommended authentication endpoint is https://login.partner.microsoftonline.cn.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Tanmoy Satpati 20 Reputation points

2025-02-12T05:23:17.7933333+00:00

Thank you @Xintao Qiao-MSFT , for confirming.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Need information on Microsoft Message Trace GCC Support to request OAuth Token

0 additional answers

Your answer