An app registration per cloud
Microsoft requires an app to be registered in each national cloud’s own portal. A token from one cloud is not valid in another. National clouds
Providers
A mail and calendar API for Microsoft 365 GCC High and DoD.
Each US government cloud has its own sign-in and Graph hosts. Workwae stores the cloud with every account and app, and calls that cloud’s hosts.
Hosts per cloud
Four clouds, four sets of endpoints.
GCC (moderate) uses the worldwide endpoints, so it behaves like a commercial tenant. Sources: Graph deployments, GCC High endpoints, DoD endpoints.
| Cloud | Sign-in | Graph | IMAP |
|---|---|---|---|
| Worldwide, including GCC | login.microsoftonline.com | graph.microsoft.com | outlook.office365.com |
| GCC High | login.microsoftonline.us | graph.microsoft.us | outlook.office365.us |
| DoD | login.microsoftonline.us | dod-graph.microsoft.us | outlook-dod.office365.us |
| 21Vianet | login.chinacloudapi.cn | microsoftgraph.chinacloudapi.cn | partner.outlook.cn |
What changes for an integration
Separate apps, tokens and a few missing calls.
The GCC High email API article walks through each point. In short:
Fewer Graph calls
Message delta and subscriptions are available in GCC High and DoD. permanentDelete is not. message: delta, permanentDelete, subscriptions
No personal accounts
Consumer accounts are only in the worldwide service. Apps in a national cloud reach organizational data. Graph deployments
What Workwae does
One workspace, accounts in different clouds.
Cloud stored with the account
Every Microsoft account and OAuth app records its cloud, and the account reports it as cloud. Sign-in, scopes and Graph calls use that cloud’s hosts, and delegated scopes carry its Graph root.
Your app, or ours where we run one
Register your own app for each cloud and pass its id when sign-in starts. Workwae’s app is used only for clouds where Workwae runs one; for any other, headless OAuth answers provider_not_configured.
Same sync as commercial
Mail, calendar and contacts use delta queries and Outlook subscriptions on the cloud’s Graph host. If a subscription cannot be created, the account is polled.
Permanent delete
In GCC High and DoD, a permanent delete is sent as a normal delete, which moves the message to Recoverable Items instead of purging it.
For the buyer’s side, including US data hosting and organization connections, see the government use case.
SDK
Register the app once per cloud.
The app carries its cloud, so accounts that sign in through it live in that cloud.
const app = await workwae.oauthApps.create({
provider: "microsoft",
cloud: "gcc-high",
name: "Example Mail",
clientId: process.env.ENTRA_CLIENT_ID!,
clientSecret: process.env.ENTRA_CLIENT_SECRET!,
authority: process.env.ENTRA_DIRECTORY_ID!,
});
const { authorizeUrl } = await workwae.oauthAuthorizations.create({
provider: "microsoft",
oauthAppId: app.id,
redirectUri: "https://app.example.com/mail/connected",
});import os
app = workwae.oauth_apps.create(
provider="microsoft",
cloud="gcc-high",
name="Example Mail",
client_id=os.environ["ENTRA_CLIENT_ID"],
client_secret=os.environ["ENTRA_CLIENT_SECRET"],
authority=os.environ["ENTRA_DIRECTORY_ID"],
)
result = workwae.oauth_authorizations.create(
provider="microsoft",
oauth_app_id=app.id,
redirect_uri="https://app.example.com/mail/connected",
)
authorize_url = result.authorize_url FAQ
Questions teams ask.
Is GCC the same as GCC High?
No. GCC (moderate) runs on the worldwide endpoints and connects as global. GCC High and DoD are separate clouds with their own hosts.
Can an MX lookup tell me which cloud a domain is in?
Not fully. Mail to GCC High and DoD both goes through protection.office365.us, so ask the customer which cloud applies.
Can a tenant admin approve the app for everyone?
Yes. An organization connection uses app-only access with admin consent and works in GCC High and DoD through your own app registration. See organizations.
Does 21Vianet use Graph?
Not for mail. Message delta is not offered there, so those mailboxes connect over IMAP and SMTP. See Microsoft 365.
Early access
Bring commercial and government tenants.
Tell us which Microsoft clouds your users are in.