GCC-High (Government Community Cloud High)

​

Cloud Endpoints

​

Implementation Details

CloudEnvironment.GCCHigh => 
  ("https://graph.microsoft.us/beta", AzureAuthorityHosts.AzureGovernment)

• Authority URI: https://login.microsoftonline.us

​

Compliance & Certifications

​

Data Residency

• Physical location: US government datacenters only
• Personnel: All support personnel are US citizens with government screening
• Isolation: Physically and logically isolated from Commercial and GCC clouds
• Encryption: All data encrypted at rest and in transit

​

App Registration

​

Prerequisites

• Global Administrator or Application Administrator role in Entra ID
• GCC-High tenant
• Access to the Azure Government Portal: https://portal.azure.us

​

Registration Steps

​

1. Create App Registration

1. Sign in to the Azure Government Portal with your GCC-High credentials
2. Navigate to Entra ID > App registrations > New registration
3. Configure the registration:
   • Name: Intune Commander - GCC-High (or your preferred name)
   • Supported account types: Accounts in this organizational directory only (single tenant)
   • Redirect URI:
     • Platform: Mobile and desktop applications
     • URI: http://localhost:45132
   • Click Register

​

2. Note Registration Details

• Application (client) ID - Found on the Overview page
• Directory (tenant) ID - Found on the Overview page

​

3. Configure API Permissions

DeviceManagementConfiguration.ReadWrite.All
DeviceManagementApps.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
DeviceManagementManagedDevices.Read.All
DeviceManagementRBAC.ReadWrite.All
DeviceManagementScripts.ReadWrite.All

Policy.ReadWrite.ConditionalAccess
Policy.Read.All
Agreement.ReadWrite.All

Organization.Read.All
OrganizationalBranding.ReadWrite.All

Group.Read.All
GroupMember.Read.All

CloudPC.ReadWrite.All

​

4. Grant Admin Consent

1. Still on the API permissions page
2. Click Grant admin consent for [Your Organization]
3. Click Yes to confirm
4. Verify all permissions show a green checkmark in the Status column

​

5. (Optional) Configure Client Secret

1. Navigate to Certificates & secrets
2. Click New client secret
3. Add a description: Intune Commander Service Principal
4. Select expiration: 12 months (recommended)
5. Click Add
6. Immediately copy the secret value - it will not be shown again

​

Authentication Methods

​

Interactive Browser (Default)

• Auth Method: Interactive
• Client Secret: (leave blank)

• Opens browser window to login.microsoftonline.us
• Supports MFA, Conditional Access, and all Entra ID features
• Token cached locally for persistent sessions
• Automatically uses GCC-High authority host

var credential = new InteractiveBrowserCredential(
    new InteractiveBrowserCredentialOptions
    {
        TenantId = profile.TenantId,
        ClientId = profile.ClientId,
        AuthorityHost = new Uri("https://login.microsoftonline.us"),
        RedirectUri = new Uri("http://localhost:45132")
    }
);

​

Client Secret (Service Principal)

• Auth Method: ClientSecret
• Client Secret: (paste the secret value)

• No user interaction required
• Authenticates as the application identity
• Secrets encrypted and stored in the profile file
• Automatically uses GCC-High authority host

var credential = new ClientSecretCredential(
    profile.TenantId,
    profile.ClientId,
    profile.ClientSecret,
    new ClientSecretCredentialOptions
    {
        AuthorityHost = new Uri("https://login.microsoftonline.us")
    }
);

​

Profile Configuration

​

Creating a Profile

1. Launch Intune Commander
2. Fill in the profile details:
   • Profile Name: Agency-GCCHigh-Production
   • Tenant ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (from portal.azure.us)
   • Client ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (from portal.azure.us)
   • Cloud: GCCHigh (critical—select this, not Commercial or GCC)
   • Auth Method: Interactive or ClientSecret
   • Client Secret: (if using ClientSecret auth method)
3. Click Save Profile

​

JSON Profile Format

[
  {
    "name": "Agency-GCCHigh-Production",
    "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "cloud": "GCCHigh",
    "authMethod": "Interactive"
  }
]

​

Supported Features

​

Differences from Commercial & GCC

​

Technical Differences

​

Service Availability

• Core features: Usually available within 2-4 weeks
• Preview features: May not be available or significantly delayed
• Third-party integrations: Limited compared to Commercial

​

Network Requirements

​

Required Outbound Connectivity

​

Proxy Support

• Windows: Internet Options proxy settings
• macOS/Linux: System environment variables (HTTP_PROXY, HTTPS_PROXY)

​

Troubleshooting

​

Wrong Cloud Selected

1. Verify you selected GCCHigh when creating the profile
2. Delete the profile and recreate with correct cloud selection
3. Clear cached tokens: Delete %LocalAppData%\.IdentityService\msal.cache

​

App Registration in Wrong Portal

1. Verify app registration was created in portal.azure.us (not portal.azure.com)
2. Create a new app registration in the correct portal
3. Update profile with new Client ID from portal.azure.us

​

Endpoint Mismatch

1. Verify profile cloud is set to GCCHigh
2. Check network connectivity to graph.microsoft.us and login.microsoftonline.us
3. Ensure firewall allows outbound HTTPS to *.microsoft.us
4. Test connectivity: curl https://graph.microsoft.us/beta

​

Permission Propagation Delays

1. Wait 15-30 minutes after granting admin consent
2. Sign out and sign back in to refresh token
3. Use Permission Check feature to verify JWT token claims
4. Contact Microsoft support if permissions don’t propagate after 1 hour

​

Migration from Commercial or GCC

​

Moving Configurations to GCC-High

1. Export from source tenant:
   • Connect to Commercial or GCC tenant in Intune Commander
   • Export all configurations to a folder
2. Review for compliance:
   • Ensure configurations meet GCC-High compliance requirements
   • Remove references to third-party services not approved for CUI
   • Update URLs to government-specific endpoints (if any hardcoded)
3. Import to GCC-High tenant:
   • Create app registration in portal.azure.us
   • Create GCCHigh profile in Intune Commander
   • Import configurations from the export folder
   • Review and update assignments (groups won’t migrate automatically)
4. Test thoroughly:
   • Validate Conditional Access policies with pilot group
   • Test device enrollment and compliance evaluation
   • Verify app deployments and MAM policies

​

Related Resources

• Azure Government Portal
• Microsoft 365 GCC-High Service Description
• Intune for US Government GCC-High
• DoD Cloud Configuration (for IL5+ requirements)