Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
By default, the Microsoft Graph SDKs are configured to access data in the Microsoft Graph global service, using the https://graph.microsoft.com
root URL to access the Microsoft Graph REST API. Developers can override this configuration to connect to Microsoft Graph national cloud deployments.
Prerequisites
You will need the following information to configure a Microsoft Graph SDK to connect to a national cloud deployment.
- Application registration details, such as client ID, tenant ID, and client secret or certificate. The application registration MUST be created in the Microsoft Entra admin center that corresponds to the national cloud deployment. See App registration and token service root endpoints for details.
- The token endpoint for the national cloud deployment.
- The Microsoft Graph service root endpoint for the national cloud deployment. See Microsoft Graph and Graph Explorer service root endpoints for a list of endpoints.
Configure the SDK
In order to connect to a national cloud deployment, you must configure your authentication provider to connect to the correct token service endpoint. Then you must configure the SDK client to connect to the correct Microsoft Graph service root endpoint.
Permission scopes
Any permission scope value (including the .default
scope) that contains the Microsoft Graph ___domain MUST use the ___domain of the Microsoft Graph service root endpoint for the national cloud deployment. The shortened permission scope names, such as User.Read
or Mail.Send
, are also valid.
- For incremental or dynamic consent,
User.Read
andhttps://graph.microsoft.us/User.Read
are equivalent for the US Government L4 national cloud. - For statically defined permissions, or if you are using client credentials flow for app-only permissions,
https://graph.microsoft.us/.default
is the correct.default
scope value.
Examples
The following example configures an Interactive authentication provider with the Microsoft Graph SDK to connect to the Microsoft Graph for US Government L4 national cloud.
// Create the InteractiveBrowserCredential using details
// from app registered in the Azure AD for US Government portal
var credential = new InteractiveBrowserCredential(
"YOUR_TENANT_ID",
"YOUR_CLIENT_ID",
new InteractiveBrowserCredentialOptions
{
// https://login.microsoftonline.us
AuthorityHost = AzureAuthorityHosts.AzureGovernment,
RedirectUri = new Uri("YOUR_REDIRECT_URI"),
});
// Create the authentication provider
var authProvider = new AzureIdentityAuthenticationProvider(
credential,
isCaeEnabled: true,
scopes: ["https://graph.microsoft.us/.default"]);
// Create the Microsoft Graph client object using
// the Microsoft Graph for US Government L4 endpoint
// NOTE: The API version must be included in the URL
var graphClient = new GraphServiceClient(
authProvider,
"https://graph.microsoft.us/v1.0");