We have a standard provider hosted app that works in normal SharePoint online tenancies. We need to use the same for a US Gov customer and their SPOnline tenancy is in gov cloud. Currently we get (401) Unauthorized error when we try to create context in app installed event in the Azure component.

As per this article, we need to change tokenhelper.cs. However, 'Azure ACS endpoints' as given in this article is same for Production and US Government. Though 'Azure AD endpoints' is different, we don't understand where this needs to be changed in the code. Though article mentions PnP but I would really like to understand what changes are required in standard code to make it work.

Specific questions that I have:

  1. Can the same provider hosted app instance work in Production / US Gov / German etc. clouds or we need separate instances
  2. Can the provider hosted component deployed in normal Azure instance, work with US Gov tenancy or it has to be hosted in US Gov Azure only
  3. As per the article, AcsHostUrl has to be changed. How can tokenhelper.cs recognize which AcsHostUrl to use depending on the request received. This is for case where same instance of web app will handle requests from different clouds
  4. Any sample project that works with both environments or just the US Gov cloud


  • As someone who also works for the GOV. NIPR environmental practices and internal operations are considered FOUO and should not be directly queried in a public forum. I would discuss this with you tennet owners and see if there is something blocking your ability to do this over a GOV network. I would also consult your security manager before posting specific questions in regards to GOV practices and future projects. You should frame your question in a different way. – lazoDev Feb 27 '19 at 20:24
  • @lazoDev My question is entirely in context of the public Microsoft link included in the article. There are no details of specific projects or internal operations etc. If you can point out something specific, I will be happy to revise. – Prakash Feb 27 '19 at 20:39
  • Not according to my security manager it is not. – lazoDev Feb 27 '19 at 20:41
  • @lazoDev I have read my question again and don't see any reason to be hysterical. You can substitute US Gov with Germany above to soothe the nerves as it also uses a different cloud and begs the same set of questions. And I reiterate that I will promptly remove whatever specifics you can point out to be not conforming to security considerations. – Prakash Feb 28 '19 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.