DoD (Department of Defense)

​

Cloud Endpoints

​

Implementation Details

CloudEnvironment.DoD => 
  ("https://dod-graph.microsoft.us/beta", AzureAuthorityHosts.AzureGovernment)

• Authority URI: https://login.microsoftonline.us

​

Compliance & Certifications

​

Data Residency & Isolation

• Physical location: US DoD datacenters with DISA authorization
• Personnel: All personnel are US citizens with Secret or Top Secret clearances
• Isolation: Physically and logically isolated from all other clouds including GCC-High
• Encryption: FIPS 140-2 validated encryption at rest and in transit
• Network: Isolated network infrastructure with no connectivity to public cloud

​

App Registration

​

Prerequisites

• Global Administrator or Application Administrator role in Entra ID
• DoD tenant
• Access to the Azure Government Portal: https://portal.azure.us
• DoD email address and credentials

​

Registration Steps

​

1. Create App Registration

1. Sign in to the Azure Government Portal with your DoD credentials
2. Navigate to Entra ID > App registrations > New registration
3. Configure the registration:
   • Name: Intune Commander - DoD (or your preferred name)
   • Supported account types: Accounts in this organizational directory only (single tenant)
   • Redirect URI:
     • Platform: Mobile and desktop applications
     • URI: http://localhost:45132
   • Click Register

​

2. Note Registration Details

• Application (client) ID - Found on the Overview page
• Directory (tenant) ID - Found on the Overview page

​

3. Configure API Permissions

DeviceManagementConfiguration.ReadWrite.All
DeviceManagementApps.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
DeviceManagementManagedDevices.Read.All
DeviceManagementRBAC.ReadWrite.All
DeviceManagementScripts.ReadWrite.All

Policy.ReadWrite.ConditionalAccess
Policy.Read.All
Agreement.ReadWrite.All

Organization.Read.All
OrganizationalBranding.ReadWrite.All

Group.Read.All
GroupMember.Read.All

CloudPC.ReadWrite.All

​

4. Grant Admin Consent

1. Still on the API permissions page
2. Click Grant admin consent for [Your Organization]
3. Click Yes to confirm
4. Verify all permissions show a green checkmark in the Status column

​

5. (Optional) Configure Client Secret

1. Navigate to Certificates & secrets
2. Click New client secret
3. Add a description: Intune Commander Service Principal
4. Select expiration: 12 months (recommended)
5. Click Add
6. Immediately copy the secret value - it will not be shown again

​

Authentication Methods

​

Interactive Browser (Default)

• Auth Method: Interactive
• Client Secret: (leave blank)

• Opens browser window to login.microsoftonline.us
• Supports MFA, CAC/PIV authentication, and all Entra ID features
• Token cached locally for persistent sessions
• Automatically uses DoD Graph endpoint (dod-graph.microsoft.us)

var credential = new InteractiveBrowserCredential(
    new InteractiveBrowserCredentialOptions
    {
        TenantId = profile.TenantId,
        ClientId = profile.ClientId,
        AuthorityHost = new Uri("https://login.microsoftonline.us"),
        RedirectUri = new Uri("http://localhost:45132")
    }
);

​

Client Secret (Service Principal)

• Auth Method: ClientSecret
• Client Secret: (paste the secret value)

• No user interaction required
• Authenticates as the application identity
• Secrets encrypted and stored according to local security requirements
• Automatically uses DoD Graph endpoint

var credential = new ClientSecretCredential(
    profile.TenantId,
    profile.ClientId,
    profile.ClientSecret,
    new ClientSecretCredentialOptions
    {
        AuthorityHost = new Uri("https://login.microsoftonline.us")
    }
);

​

Profile Configuration

​

Creating a Profile

1. Launch Intune Commander
2. Fill in the profile details:
   • Profile Name: DoD-Production or [Branch]-DoD-[Environment]
   • Tenant ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (from portal.azure.us)
   • Client ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (from portal.azure.us)
   • Cloud: DoD (critical—select this, not GCCHigh, GCC, or Commercial)
   • Auth Method: Interactive or ClientSecret
   • Client Secret: (if using ClientSecret auth method)
3. Click Save Profile

​

JSON Profile Format

[
  {
    "name": "DoD-Production",
    "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "cloud": "DoD",
    "authMethod": "Interactive"
  }
]

​

Supported Features

​

Differences from Other Clouds

​

Technical Differences

​

Service Availability

• Core features: Usually available within 4-6 weeks
• Security features: Prioritized, may arrive sooner
• Preview features: Often not available or significantly delayed
• Third-party integrations: Severely limited; only DoD-approved services

​

Network Requirements

​

Required Outbound Connectivity

​

Proxy and Firewall Configuration

• Windows: Internet Options proxy settings
• macOS/Linux: System environment variables (HTTP_PROXY, HTTPS_PROXY)

• *.microsoft.us (all subdomains)
• *.microsoftonline.us (all subdomains)
• *.windows.net (Azure services)

​

CAC/PIV Authentication

1. Ensure smart card middleware is installed on the client machine
2. Use Interactive authentication method
3. Browser will prompt for smart card PIN during authentication
4. Token is cached after initial authentication (valid for 1 hour by default)

​

Troubleshooting

​

Wrong Graph Endpoint

1. Verify you selected DoD (not GCCHigh) when creating the profile
2. Delete the profile and recreate with correct cloud selection
3. Clear cached tokens: Delete %LocalAppData%\.IdentityService\msal.cache

​

App Registration in Wrong Cloud

1. Verify app registration was created in portal.azure.us (not portal.azure.com)
2. Ensure app is registered in your DoD tenant (not GCC-High, GCC, or Commercial)
3. Create a new app registration in the correct tenant
4. Update profile with new Client ID from DoD tenant

​

Network Connectivity Issues

1. Test connectivity: nslookup dod-graph.microsoft.us
2. Test HTTPS access: curl https://dod-graph.microsoft.us/beta
3. Verify firewall allows outbound HTTPS (443) to *.microsoft.us
4. Check proxy configuration allows dod-graph.microsoft.us
5. Contact your NOC if connectivity issues persist

​

CAC/PIV Authentication Failures

1. Verify smart card middleware is installed and functional
2. Test smart card: Sign in to portal.azure.us in browser
3. Ensure browser supports smart card authentication (Edge recommended)
4. Clear browser certificates and retry
5. Contact your PKI team if smart card issues persist

​

Permission Propagation Delays

1. Wait 30-60 minutes after granting admin consent (DoD propagation is slower)
2. Sign out and sign back in to refresh token
3. Use Permission Check feature (View menu) to verify JWT token claims
4. Contact Microsoft DoD support if permissions don’t propagate after 2 hours

​

Migration to DoD Cloud

​

Moving Configurations from Other Clouds

1. Export from source tenant:
   • Connect to source tenant (Commercial, GCC, or GCC-High) in Intune Commander
   • Export all configurations to a folder
2. Security and compliance review:
   • Critical: Review all configurations for DoD compliance requirements
   • Remove references to third-party services not authorized for DoD use
   • Ensure all URLs, scripts, and app references meet IL5 requirements
   • Review with your ISSM (Information Systems Security Manager)
3. Create DoD app registration:
   • Register app in portal.azure.us in your DoD tenant
   • Grant all required permissions
   • Wait 30-60 minutes for permission propagation
4. Import to DoD tenant:
   • Create DoD profile in Intune Commander
   • Import configurations from the export folder
   • Review and update all assignments (groups won’t migrate automatically)
   • Update any hardcoded endpoints to DoD equivalents
5. Test and validate:
   • Test with pilot group before broad deployment
   • Validate Conditional Access policies don’t block critical access
   • Test device enrollment and compliance evaluation
   • Verify app deployments work in DoD environment

​

Related Resources

• Azure Government Portal
• Microsoft 365 DoD Service Description
• Intune for US Government DoD
• DISA Cloud Computing SRG
• GCC-High Configuration (for IL4 requirements)