Custom Azure endpoints for Entra ID and Intune integrations

In this topic, you will learn how to retrieve and configure custom endpoints in Microsoft Entra ID and Microsoft Intune for sovereign and national cloud environments.

Organizations operating in sovereign or national cloud environments (such as Azure operated by 21Vianet in China) run under specific data residency and sovereignty regulations. These environments use entirely separate portals, app registrations, and endpoint domains from the standard commercial cloud, meaning global Entra ID application registrations cannot be reused and endpoint values must be entered manually. Below you will find information on where to find such information or how to request it from Microsoft.

Most information is included in the Endpoints panel for your Entra ID app. This panel can be directly accessed from the Entra ID admin center or via the Intune admin center.

  • From Microsoft Entra ID: Log into your cloud instance admin portal (for example, portal.azure.cn for China operated by 21Vianet), and navigate to Microsoft Entra ID > App registrations > your_app > Endpoints.

  • From Microsoft Intune: Log into the Intune admin center for your cloud instance (for example, intune.microsoftonline.cn) and navigate to All Services > Other consoles > Microsoft Entra to open the Entra ID admin center, then select App registrations > your_app > Endpoints.

Custom endpoint parameters for sovereign and national clouds:

  • Authentication endpoint: In the Endpoints panel, copy the base domain from the OAuth 2.0 token endpoint (v2) field, stopping after the domain (for example, https://login.chinacloudapi.cn/). Do not include the tenant ID or /oauth2/v2.0/token suffix.

  • Graph API endpoint: Copy the URL directly from the Microsoft Graph API endpoint field at the bottom of the same Endpoints panel (for example, https://microsoftgraph.chinacloudapi.cn).

  • Intune resource: In the Intune admin center for your cloud instance, go to Reports > Data warehouse and copy the base domain from the Data warehouse feed URL field (for example, fef.your_tenant.manage.microsoft.cn or fef.your_tenant.manage.microsoft.us). Drop the path starting with /ReportingService/... and any query string. If this menu path is unavailable in your tenant, open a support request with Microsoft.

  • Default scope: Type .default directly into this field. This fixed OAuth 2.0 literal is identical across all cloud instances, but remains editable for custom deployments in the future that may require a different scope literal.