Utilizing PowerSyncPro with an Azure GCC High Tenant

 If you plan on using PowerSyncPro to interact with a Microsoft Azure GCC High Tenant (typically reserved for the US Government and its contractors), you must make a few configuration changes to the server before adding the tenant to the application. 

GCC High is fully supported as a source and target location for both PowerSyncPro DirSync and the Migration Agent in Version 3.3 or above.

Prerequisites

• PowerSyncPro Server Installation Version 3.3 or above.
• PowerSyncPro Migration Agent Version 3.3 or above installed on endpoints.
• A Microsoft Azure GCC High Tenant.
• An Application Registration configured in the GCC High Tenant.
  • Note: Because the Entra Registration PowerShell Script does not yet support GCC High, this registration must be created manually. Please review the manual creation steps in the PowerSyncPro Migration Server Prerequisites Guide.

Enabling GCC High Support

GCC High support is currently gated behind a feature flag in PowerSyncPro. It must be manually enabled via the appsettings.json file on the central PowerSyncPro server.

1. Connect to the PowerSyncPro server console (via RDP, etc.).
2. Open Notepad as an Administrator.
3. Open the following file: C:\Program Files\PowerSyncPro\appsettings.json
4. Between the "Logging" and "JobConfig" sections, add a new "FeatureSwitches" section containing the "AllowEntraIdCloudChoice" flag, as shown below:

"FeatureSwitches" : {
        "AllowEntraIdCloudChoice": true
    },

1. Save the appsettings.json file.
2. Restart the PowerSyncPro Service via the Windows Services console.
3. Log in to the PowerSyncPro web interface to ensure the service started successfully.

Adding a GCC High Directory

Once the feature flag is active, you can add your GCC High tenant to PowerSyncPro.

1. Log in to PowerSyncPro.
2. Navigate to Sync Service → Directories and click Create.
3. Choose Entra ID as the Directory Type.
4. Configure the following settings:
   • Display Name: Choose a name relevant to your installation (e.g., GCC High Target).
   • Azure Type: Select Azure US Government DoD.
   • Tenant ID: Enter the Directory (tenant) ID from your manual App Registration.
   • Application ID: Enter the Application (client) ID from your manual App Registration.
   • Client Secret: Enter the Client Secret Value from your manual App Registration.
   • Import Object Types: Select Users and Devices at a minimum. (Only select additional data like Groups or Contacts if required for your specific synchronization scope).
5. Click Save.

Upon saving, PowerSyncPro will validate the configuration, attempt to connect to the GCC High Entra environment, and pull basic information including the directory schema.

Create Directory

Getting a Bulk Enrollment Token for Migration Agent

If you are planning to use your GCC High tenant as a target for workstation migrations, you must obtain a Bulk Enrollment Token (BPRT). This token allows the local Migration Agents to programmatically join endpoints to the Entra GCC High environment.

1. Edit your newly created GCC High directory entry.
2. Click the Generate Bulk Enrollment Token button.
3. Provide a descriptive name for the token and click Generate.
4. A Microsoft Authentication browser pop-up will appear. Log in to your GCC High tenant using an account with sufficient privileges (e.g., Intune Admin, Global Admin).
5. Once authenticated, verify that the Bulk Enrollment Token section is now populated and save the directory profile.

GCC High Directory Entry - Verify Authority URL

Complete!

PowerSyncPro is now connected to your GCC High tenant, and you have a valid bulk enrollment token staged to join endpoints to Entra. From this point forward, you can configure your Sync Profiles, Runbooks, and Batches exactly as you would with a traditional commercial Microsoft 365 tenant.