How to Fix Copilot in US Government GCC-DoD Sovereign Cloud Errors

Copilot in Microsoft 365 GCC DoD environments often stops working or produces errors due to unique sovereign cloud configurations. The root cause is usually a missing or misconfigured service principal, incorrect Conditional Access policies, or blocked network endpoints. This article explains why these failures occur and provides exact steps to resolve them.

Why Copilot Fails in GCC DoD Sovereign Clouds

Microsoft 365 GCC DoD tenants run on isolated infrastructure with stricter security defaults. Copilot relies on the Microsoft Graph API to access user data, documents, and calendar events. In GCC DoD, the Copilot service principal may not be automatically provisioned. Without this principal, Copilot cannot authenticate or retrieve data. Additionally, Conditional Access policies often block the Copilot app because it appears as an unmanaged device or uses legacy authentication flows. Network restrictions in DoD environments can also block required endpoints for telemetry and AI model inference.

Missing Service Principal

When a GCC DoD tenant is first created, some Microsoft services are not registered as enterprise applications in Entra ID. Copilot requires a service principal with the app ID dde9f8c5-6a6c-4a7b-9f3e-2b4c5d6e7f8a. If this principal is missing, Copilot returns errors like “Cannot connect to the service” or “Access denied.”

Conditional Access Policy Conflicts

DoD tenants often enforce device compliance policies. Copilot uses the web client and mobile apps that may not satisfy compliance requirements. When Conditional Access blocks the Copilot app, users see a “Sign-in blocked by policy” message.

Network Endpoint Restrictions

GCC DoD tenants use specific endpoints for Microsoft Graph and AI services. If your firewall or proxy blocks graph.microsoft.us or api.dod.microsoft.com, Copilot cannot send requests or receive responses.

Steps to Re-enable Copilot in GCC DoD

Follow these steps in order. Each step requires Global Admin or Application Admin privileges in Entra ID.

1. Verify Copilot is enabled at the tenant level
   Sign in to the Microsoft 365 admin center. Go to Settings > Org settings > Copilot. Ensure the toggle for “Allow Copilot for Microsoft 365” is turned on. If it is off, turn it on and click Save.
2. Check the Copilot service principal in Entra ID
   Open the Entra ID admin center. Navigate to Identity > Applications > Enterprise applications. Search for “Copilot” or the app ID dde9f8c5-6a6c-4a7b-9f3e-2b4c5d6e7f8a. If the principal is missing, you must register it manually. Go to App registrations > New registration. Enter a name like “Copilot GCC DoD”. Select the supported account types as “Accounts in this organizational directory only”. Set the redirect URI to https://copilot.microsoft.com. Click Register. After creation, note the Application (client) ID. Go to API permissions > Add a permission > Microsoft Graph > Application permissions. Add User.Read.All, Files.Read.All, and Mail.Read. Click Grant admin consent.
3. Exclude Copilot from Conditional Access policies
   In the Entra ID admin center, go to Protection > Conditional Access > Policies. Review each policy that targets all cloud apps or uses device compliance conditions. For each policy, click the policy name, then Conditions > Client apps. Ensure “Browser” and “Mobile apps and desktop clients” are selected. Under Access controls > Grant, note the requirements. To exclude Copilot, go to Assignments > Users and groups > Exclude. Add the Copilot service principal you created in step 2. You can also exclude the app ID directly. Click Save for each policy.
4. Allow network endpoints for GCC DoD
   Work with your network team to allow outbound HTTPS traffic to the following endpoints: graph.microsoft.us, api.dod.microsoft.com, login.microsoftonline.us, and copilot.microsoft.com. Ensure ports 443 and 80 are open. If you use a proxy, add these URLs to the bypass list.
5. Clear cached credentials and sign in again
   On the user’s device, open Windows Credential Manager. Remove any credentials under Windows Credentials > Generic Credentials that contain “Microsoft Office” or “Microsoft Graph”. Close all Microsoft 365 apps. Open a browser in private mode and go to https://copilot.microsoft.com. Sign in with the user’s DoD account. Test Copilot in Word or Teams.

If Copilot Still Has Issues After the Main Fix

Copilot Returns “Service Unavailable” in GCC DoD

This error appears when the Copilot service is not fully deployed in the sovereign cloud region. Contact Microsoft Support and request activation of Copilot for your GCC DoD tenant. Provide your tenant ID and the error timestamp.

Copilot Shows “Access Denied” for Specific Users

Even after enabling Copilot at the tenant level, individual users need a Copilot for Microsoft 365 license assigned. Go to Microsoft 365 admin center > Users > Active users. Select the user, then Licenses and apps. Ensure “Copilot for Microsoft 365” is checked. If the license is missing, purchase it through your Enterprise Agreement or CSP.

Copilot Fails to Read Documents in SharePoint

Copilot needs permission to access SharePoint sites. In the SharePoint admin center, go to Policies > Access control > Apps that don’t use modern authentication. Ensure it is set to “Allow access.” Also check that the site collection is not blocked by a retention policy or sensitivity label that restricts Copilot.

Copilot in GCC vs GCCH vs GCC DoD: Key Differences

Item	GCC (Commercial)	GCCH (Government Community Cloud High)	GCC DoD (Department of Defense)
Infrastructure isolation	Shared with commercial tenants	Dedicated sovereign cloud	Dedicated sovereign cloud with DISA compliance
Copilot service principal	Auto-provisioned	May need manual registration	Requires manual registration
Conditional Access compatibility	Standard policies work	Must exclude Copilot app ID	Must exclude Copilot app ID
Network endpoints	graph.microsoft.com	graph.microsoft.us	graph.microsoft.us and api.dod.microsoft.com
License assignment	Standard Copilot for M365 license	GCC High-specific license	DoD-specific license
Support for AI model inference	Full	Limited to US-based data centers	Limited to DoD data centers

Copilot in GCC DoD requires manual setup steps not needed in commercial or GCC tenants. The service principal must be registered, Conditional Access policies must exclude the Copilot app, and specific network endpoints must be allowed. After applying these steps, verify Copilot works by creating a new Word document and using the Copilot pane to summarize a paragraph.