> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curator.interworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# US Government Cloud (GCC) Setup

> Configure Curator to connect to Power BI tenants hosted in Microsoft US Government sovereign clouds (GCC, GCC High, DoD).

export const BackendNavPath = ({levelOne, levelTwo, levelThree, tab, section}) => {
  const levels = [levelOne, levelTwo, levelThree].filter(Boolean);
  const lastLevel = levels.length ? levels[levels.length - 1] : '';
  return <span>
      In the <a href="/setup/installation/linux_installation">backend of Curator</a> using the left-hand navigation,
      navigate to the
      {levelOne && <strong>{" " + levelOne}</strong>}
      {levelOne && levelTwo && " > "}
      {levelTwo && <strong>{levelTwo}</strong>}
      {levelTwo && levelThree && " > "}
      {levelThree && <strong>{levelThree}</strong>} page.
      {(tab || section) && <>
          {" "}On the {lastLevel} page
          {tab && <> click the <strong>{tab}</strong> tab</>}
          {tab && section && " and"}
          {section && <> expand the <strong>{section}</strong> section</>}.
        </>}
    </span>;
};

Power BI tenants on Microsoft US Government licenses (GCC, GCC High, or DoD) live in
sovereign clouds with different REST API and authentication endpoints than the commercial
Power BI service. Curator supports these sovereign clouds, but the connection must be
configured to route requests to the correct endpoints. This page covers the differences
from the standard commercial setup.

If your Power BI tenant is on a standard commercial Microsoft license, you do not need this
page. Follow the standard [Curator Connection](./curator_connection) flow instead.

## Selecting the Cloud Environment

When configuring the Curator Power BI connection (under **Integrations** > **Connections**),
the **Cloud Environment** dropdown at the top of the Power BI Connection section determines
which Microsoft cloud Curator targets for all API and authentication calls.

| Option                                                     | When to use it                                              |
| ---------------------------------------------------------- | ----------------------------------------------------------- |
| **Commercial (default)**                                   | Standard Power BI tenants on commercial Microsoft licenses. |
| **US Government Community Cloud (GCC)**                    | Power BI tenants on a GCC license.                          |
| **US Government Community Cloud High (GCC High / DoDCON)** | Power BI tenants on a GCC High license.                     |
| **US Department of Defense (DoD)**                         | Power BI tenants on a DoD license.                          |

Existing Power BI connections that predate this setting continue to use the Commercial cloud
without any change in behavior.

## Differences When Registering Azure Apps for GCC

Most of the [Azure App Setup](./azure_app_setup) steps still apply, with two specific
differences for sovereign cloud tenants:

### 1. Use the Government Power BI Service API

When adding API permissions to the registered app, the **"Power BI Service"** API listed by
default in Azure is the commercial version and will not work for sovereign cloud tenants.
Instead, search under **APIs my organization uses** for:

> **Microsoft Power BI Government Community Cloud**
> Application (client) ID: `fc4979e5-0aa5-429f-b13a-5d1365be5566`

Grant the same delegated permissions described in the standard setup, but on this
government-specific API.

### 2. The "Allow service principals to use Fabric APIs" Tenant Setting Does Not Exist

Microsoft Fabric is not deployed in US Government sovereign clouds. The Power BI Admin
portal in a GCC tenant therefore does not surface the **"Allow service principals to use
Fabric APIs"** tenant setting referenced in commercial documentation.

The equivalent setting for sovereign cloud tenants is:

> **Allow service principals to use Power BI APIs**

Enable this setting and apply it to the security group containing your Curator non-admin and
admin registered apps. The **"Apply to entire organization"** toggle is typically locked in
GCC-hardened tenants, so you must use the security group approach:

1. In **Microsoft Entra**, create a security group (for example, `Curator Power BI Apps`).
2. Add both the non-admin and admin registered apps as members of that group.
3. In the **Power BI Admin portal** > **Tenant settings** > **Developer settings**, scope
   the **"Allow service principals to use Power BI APIs"** setting to that security group.
4. Apply the same scoping to any other developer settings Curator needs (for example,
   **Embed content in apps**).

## Capacity Licensing in Sovereign Clouds

Power BI capacity licensing differs in US Government clouds. Specifically, **F SKU** (Azure
Embedded) and **A SKU** capacities are not available in GCC. Only EM, P, and Premium Per User
(PPU) licensing are supported. This does not affect Curator configuration directly, but it
may affect how you license capacity for embedded reports.

## Endpoints Curator Uses Per Cloud Environment

For reference, the following endpoints are used by Curator depending on the selected cloud
environment. You do not need to configure these manually — they are derived automatically
from the Cloud Environment selection.

| Endpoint                           | Commercial                         | GCC                                      | GCC High (DoDCON)                             | DoD                                          |
| ---------------------------------- | ---------------------------------- | ---------------------------------------- | --------------------------------------------- | -------------------------------------------- |
| Power BI API base                  | `api.powerbi.com`                  | `api.powerbigov.us`                      | `api.high.powerbigov.us`                      | `api.mil.powerbigov.us`                      |
| Microsoft Entra authority          | `login.microsoftonline.com`        | `login.microsoftonline.com`              | `login.microsoftonline.us`                    | `login.microsoftonline.us`                   |
| Power BI resource (OAuth audience) | `analysis.windows.net/powerbi/api` | `analysis.usgovcloudapi.net/powerbi/api` | `high.analysis.usgovcloudapi.net/powerbi/api` | `mil.analysis.usgovcloudapi.net/powerbi/api` |

## References

* [Power BI embedding for national/government clouds](https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-sample-for-customers-national-clouds)
* [Power BI for US Government — endpoint reference](https://learn.microsoft.com/en-us/fabric/enterprise/powerbi/service-government-us-overview)
* [Microsoft Entra authentication for national clouds](https://learn.microsoft.com/en-us/entra/identity-platform/authentication-national-cloud)
* [Enable service principal authentication for admin APIs](https://learn.microsoft.com/en-us/fabric/admin/enable-service-principal-admin-apis)