---
title: "Microsoft 365 GCC High and DoD mail API · Workwae"
description: "Read and send mail, calendars and contacts in Microsoft 365 GCC High and DoD tenants through Graph, with each account kept in its own cloud."
url: https://workwae.com/providers/microsoft-365-gcc-high
---

Providers

# A mail and calendar API for Microsoft 365 GCC High and DoD.

Each US government cloud has its own sign-in and Graph hosts. Workwae stores the cloud with every account and app, and calls that cloud’s hosts.

Hosts per cloud

## Four clouds, four sets of endpoints.

GCC (moderate) uses the worldwide endpoints, so it behaves like a commercial tenant. Sources: [Graph deployments](https://learn.microsoft.com/en-us/graph/deployments), [GCC High endpoints](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-u-s-government-gcc-high-endpoints), [DoD endpoints](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-u-s-government-dod-endpoints).

Sign-in, Graph and IMAP hosts per Microsoft cloud

| Cloud | Sign-in | Graph | IMAP |
| --- | --- | --- | --- |
| Worldwide, including GCC | `login.microsoftonline.com` | `graph.microsoft.com` | `outlook.office365.com` |
| GCC High | `login.microsoftonline.us` | `graph.microsoft.us` | `outlook.office365.us` |
| DoD | `login.microsoftonline.us` | `dod-graph.microsoft.us` | `outlook-dod.office365.us` |
| 21Vianet | `login.chinacloudapi.cn` | `microsoftgraph.chinacloudapi.cn` | `partner.outlook.cn` |

What changes for an integration

## Separate apps, tokens and a few missing calls.

The [GCC High email API article](https://workwae.com/blog/gcc-high-email-api) walks through each point. In short:

### An app registration per cloud

Microsoft requires an app to be registered in each national cloud’s own portal. A token from one cloud is not valid in another. [National clouds](https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud)

### Fewer Graph calls

Message `delta` and subscriptions are available in [GCC High](https://workwae.com/glossary#gcc-high) and [DoD](https://workwae.com/glossary#dod). `permanentDelete` is not. [message: delta](https://learn.microsoft.com/en-us/graph/api/message-delta), [permanentDelete](https://learn.microsoft.com/en-us/graph/api/message-permanentdelete), [subscriptions](https://learn.microsoft.com/en-us/graph/api/subscription-post-subscriptions)

### No personal accounts

Consumer accounts are only in the worldwide service. Apps in a national cloud reach organizational data. [Graph deployments](https://learn.microsoft.com/en-us/graph/deployments)

What Workwae does

## One workspace, accounts in different clouds.

### Cloud stored with the account

Every Microsoft account and OAuth app records its cloud, and the account reports it as `cloud`. Sign-in, scopes and Graph calls use that cloud’s hosts, and delegated scopes carry its Graph root.

### Your app, or ours where we run one

Register your own app for each cloud and pass its id when sign-in starts. Workwae’s app is used only for clouds where Workwae runs one; for any other, headless OAuth answers `provider_not_configured`.

### Same sync as commercial

Mail, calendar and contacts use delta queries and Outlook subscriptions on the cloud’s Graph host. If a subscription cannot be created, the account is polled.

### Permanent delete

In GCC High and DoD, a permanent delete is sent as a normal delete, which moves the message to Recoverable Items instead of purging it.

For the buyer’s side, including US data hosting and organization connections, see the [government use case](https://workwae.com/use-cases/government).

SDK

## Register the app once per cloud.

The app carries its cloud, so accounts that sign in through it live in that cloud.

gcc-high.tsgcc-high.py

```ts
const app = await workwae.oauthApps.create({
  provider: "microsoft",
  cloud: "gcc-high",
  name: "Example Mail",
  clientId: process.env.ENTRA_CLIENT_ID!,
  clientSecret: process.env.ENTRA_CLIENT_SECRET!,
  authority: process.env.ENTRA_DIRECTORY_ID!,
});

const { authorizeUrl } = await workwae.oauthAuthorizations.create({
  provider: "microsoft",
  oauthAppId: app.id,
  redirectUri: "https://app.example.com/mail/connected",
});
```

```python
import os

app = workwae.oauth_apps.create(
    provider="microsoft",
    cloud="gcc-high",
    name="Example Mail",
    client_id=os.environ["ENTRA_CLIENT_ID"],
    client_secret=os.environ["ENTRA_CLIENT_SECRET"],
    authority=os.environ["ENTRA_DIRECTORY_ID"],
)

result = workwae.oauth_authorizations.create(
    provider="microsoft",
    oauth_app_id=app.id,
    redirect_uri="https://app.example.com/mail/connected",
)
authorize_url = result.authorize_url
```

FAQ

## Questions teams ask.

**Is GCC the same as GCC High?**

No. GCC (moderate) runs on the worldwide endpoints and connects as `global`. GCC High and DoD are separate clouds with their own hosts.

**Can an MX lookup tell me which cloud a domain is in?**

Not fully. Mail to GCC High and DoD both goes through `protection.office365.us`, so ask the customer which cloud applies.

**Can a tenant admin approve the app for everyone?**

Yes. An organization connection uses [app-only access](https://workwae.com/glossary#app-only-access) with [admin consent](https://workwae.com/glossary#admin-consent) and works in GCC High and DoD through your own app registration. See [organizations](https://workwae.com/features/organizations).

**Does 21Vianet use Graph?**

Not for mail. Message delta is not offered there, so those mailboxes connect over IMAP and SMTP. See [Microsoft 365](https://workwae.com/providers/microsoft-365).

Early access

## Bring commercial and government tenants.

Tell us which Microsoft clouds your users are in.

[Request early access](https://workwae.com/early-access/) [Read the GCC High article](https://workwae.com/blog/gcc-high-email-api)