r/AzureGov • u/JicamaParticular3421 • 19d ago

Migrated to GCC-High from Commercial errors

Hi Everyone, This week we migrated from commercial to GCC-High and the users are encountering issues with signing in. All of the DNS records were added , the domain has been verified on GCC-high. the ODC is now showing the domain is under our GCC-High tenant ID but it still points commercial but its acting very odd. For example, at the moment my outlook is showing a Fix me sign in the account. but it still shows its connected to the exchange servers so no issues.

The weirdest issue i just encountered was I was related all of the pointers to cache data and after deleting the cached data some users were able to be in the same position as my outlook but the weirdest issue was that I was recently setting up a brand new out of the box pc and this pc still gave me the error

AADSTS500011 the recource principal named https:outlook.office365.com was not found in my tenant.

Has anyone encountered this issue? if so what was the fix? and any help, advise or guidance is greatly appreciated.

2 Upvotes

100% Upvoted

10 comments sorted by

3

u/PopularPassion3513 19d ago edited 19d ago

Open a ticket with the Exchange Team and request an Autodisocver DNS cache flush for your domain.

Edit: adding more context. When switching to GCCH there is an infrastructure endpoint change. Until that DNS is flushed or TTL expires, they will point to commercial. Do these migrations all the time, also make sure there’s no MSOID record in your DNS, that will prevent activations

1

u/valar12 19d ago

This is the answer.

1

u/buckrogers 18d ago

it's always dns

3

u/valar12 19d ago

Put in a support ticket with Microsoft to clear their DNS cache. Worked for me last time I did it.

1

u/No_Actuator_4762 18d ago

Rule of thumb in these migrations is to open a support ticket and make sure ma clears their dns cache.

I did mine just like my old man, and his old man before him!

1

u/MyLegsX2CantFeelThem 19d ago

The AADSTS500011 error may actually identify the problem. https://outlook.office365.com is the Commercial Exchange Online resource, while GCC High Exchange uses outlook.office365.us. Your GCC High tenant is receiving an authentication request for a Commercial resource that doesn’t exist in that tenant.

Since you’re reproducing it on a brand-new PC, I would stop treating this primarily as an Outlook credential/cache problem.

I’d capture the Entra sign-in failure and Outlook Autodiscover results and determine why Outlook is still requesting the Commercial Exchange resource.

In particular, verify that autodiscover.<domain> resolves to autodiscover.office365.us, then inspect the actual Autodiscover response rather than just DNS. If ODC is still reporting a Commercial location despite identifying the GCC High tenant, that seems especially relevant.

Clearing WAM/Office/Outlook caches may temporarily change the symptoms on migrated machines, but it shouldn’t be necessary to make a clean PC understand that the mailbox is in GCC High.

1

u/autocuck9000 19d ago

https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/activation/reset-activation-state

Do you have AD users syncing to the cloud? If so, the Fix Me notification may be an expected artifact of message labeling or encryption applied before the switch. TL;DR: The new GCCH cloud identity for a user doesn't match the ID of the user who's supposed to have access and Outlook complains. If you can otherwise send, receive and edit messages normally in this scenario you can safely disregard the prompt. Mostly.

1

u/autocuck9000 19d ago

Also, make a new Outlook profile. The Autodiscover record for the previous domain's Exchange environment is associated with the profile and Outlook won't be redirected by default.

1

u/JicamaParticular3421 19d ago

Yes i have users syncing to cloud. I did make a new outlook profile and i deleted all the previous autodiscover files point to old tenant but still same error. It allowed me to sign in but still shows up with the same error.

1

u/7amitsingh7 16d ago

Since the issue also occurs on a brand-new PC, clearing Outlook cache is unlikely to resolve it. Check the users’ UPNs, Autodiscover settings, tenant configuration, and Office sign-in to make sure they are fully pointing to GCC-High rather than the old Commercial tenant. The `AADSTS500011` error suggests the client is still trying to authenticate against the Commercial `outlook.office365.com` resource