@@ -201,6 +201,20 @@ describe('POST /api/tools/azure_data_explorer/proxy', () => {
     })
   })
 
+  it.each([
+    ['https://c.usgovvirginia.kusto.usgovcloudapi.net', 'https://login.microsoftonline.us'],
+    ['https://c.chinanorth.kusto.chinacloudapi.cn', 'https://login.partner.microsoftonline.cn'],
+    ['https://c.eastus.kusto.windows.net', 'https://login.microsoftonline.com'],
+  ])('authenticates %s against its own cloud Entra authority', async (clusterUri, authority) => {
+    mockCluster(queryResponse({ severity: 4, statusDescription: 'Query completed successfully' }))
+
+    const response = await post({ ...baseBody, clusterUri, resource: undefined })
+
+    expect(response.status).toBe(200)
+    const [tokenUrl] = mockSecureFetch.mock.calls[0]
+    expect(tokenUrl).toBe(`${authority}/tenant-1/oauth2/token`)
+  })
+
   it('rejects a cluster URI outside the Kusto service domains', async () => {
     mockCluster(queryResponse({ severity: 4, statusDescription: 'Query completed successfully' }))
 
 
@@ -7,6 +7,7 @@ import {
   type AzureDataExplorerProxyRequest,
   assertSafeAzureDataExplorerClusterUri,
   azureDataExplorerProxyContract,
+  resolveEntraAuthority,
 } from '@/lib/api/contracts/tools/azure_data_explorer'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
@@ -22,7 +23,6 @@ export const dynamic = 'force-dynamic'
 
 const logger = createLogger('AzureDataExplorerProxyAPI')
 
-const ENTRA_AUTHORITY = 'https://login.microsoftonline.com'
 const OUTBOUND_FETCH_TIMEOUT_MS = 120_000
 const TOKEN_FETCH_TIMEOUT_MS = 30_000
 const TOKEN_CACHE_MAX_ENTRIES = 500
@@ -44,9 +44,13 @@ function resolveResource(req: AzureDataExplorerProxyRequest, clusterUrl: URL): s
   return (req.resource || clusterUrl.origin).replace(/\/+$/, '')
 }
 
-function tokenCacheKey(req: AzureDataExplorerProxyRequest, resource: string): string {
+function tokenCacheKey(
+  req: AzureDataExplorerProxyRequest,
+  authority: string,
+  resource: string
+): string {
   const secretHash = createHash('sha256').update(req.clientSecret).digest('hex').slice(0, 16)
-  return `${req.tenantId}::${req.clientId}::${secretHash}::${resource}`
+  return `${authority}::${req.tenantId}::${req.clientId}::${secretHash}::${resource}`
 }
 
 function rememberToken(key: string, token: CachedToken): void {
@@ -61,10 +65,11 @@ function rememberToken(key: string, token: CachedToken): void {
 
 async function fetchAccessToken(
   req: AzureDataExplorerProxyRequest,
+  authority: string,
   resource: string,
   requestId: string
 ): Promise<string> {
-  const cacheKey = tokenCacheKey(req, resource)
+  const cacheKey = tokenCacheKey(req, authority, resource)
   const cached = TOKEN_CACHE.get(cacheKey)
   if (cached && cached.expiresAt - TOKEN_SAFETY_WINDOW_MS > Date.now()) {
     return cached.accessToken
@@ -78,7 +83,7 @@ async function fetchAccessToken(
   })
 
   const response = await secureFetchWithValidation(
-    `${ENTRA_AUTHORITY}/${encodeURIComponent(req.tenantId)}/oauth2/token`,
+    `${authority}/${encodeURIComponent(req.tenantId)}/oauth2/token`,
     {
       method: 'POST',
       headers: {
@@ -314,7 +319,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const clusterUrl = assertSafeAzureDataExplorerClusterUri(proxyReq.clusterUri)
     const resource = resolveResource(proxyReq, clusterUrl)
-    const accessToken = await fetchAccessToken(proxyReq, resource, requestId)
+    const authority = resolveEntraAuthority(clusterUrl.hostname)
+    const accessToken = await fetchAccessToken(proxyReq, authority, resource, requestId)
 
     const headers: Record<string, string> = {
       Authorization: `Bearer ${accessToken}`,
 
@@ -4,27 +4,50 @@ import { genericToolResponseSchema } from '@/lib/api/contracts/tools/shared'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 
 /**
- * Kusto cluster host suffixes Sim will talk to. A cluster URI is user-supplied,
- * so the proxy is pinned to the documented Azure Data Explorer and Fabric
- * Eventhouse service domains rather than trusting any HTTPS host. Apex hosts
- * are allowed too, because the documented token audiences
- * (`https://api.kusto.windows.net`, `https://kusto.fabric.microsoft.com`) sit
- * at the apex.
+ * Kusto service domains Sim will talk to, each paired with the Microsoft Entra
+ * authority that issues tokens for it.
+ *
+ * A cluster URI is user-supplied, so the proxy is pinned to the documented Azure
+ * Data Explorer and Fabric Eventhouse domains rather than trusting any HTTPS
+ * host. Host and authority are declared together on purpose: a sovereign cloud
+ * authenticates against its own isolated Entra instance, so accepting a cluster
+ * host without its authority would pass validation and then fail to get a token.
+ *
+ * Apex hosts match as well as subdomains, because the documented token
+ * audiences (`https://api.kusto.windows.net`,
+ * `https://kusto.fabric.microsoft.com`) sit at the apex.
  */
-const ALLOWED_CLUSTER_HOST_SUFFIXES = [
-  'kusto.windows.net',
-  'kustomfa.windows.net',
-  'kusto.chinacloudapi.cn',
-  'kusto.usgovcloudapi.net',
-  'kusto.fabric.microsoft.com',
+const KUSTO_CLOUDS = [
+  { hostSuffix: 'kusto.windows.net', authority: 'https://login.microsoftonline.com' },
+  { hostSuffix: 'kustomfa.windows.net', authority: 'https://login.microsoftonline.com' },
+  { hostSuffix: 'kusto.fabric.microsoft.com', authority: 'https://login.microsoftonline.com' },
+  { hostSuffix: 'kusto.usgovcloudapi.net', authority: 'https://login.microsoftonline.us' },
+  { hostSuffix: 'kusto.chinacloudapi.cn', authority: 'https://login.partner.microsoftonline.cn' },
 ] as const
 
-function isAllowedKustoHost(host: string): boolean {
-  return ALLOWED_CLUSTER_HOST_SUFFIXES.some(
-    (suffix) => host === suffix || host.endsWith(`.${suffix}`)
+const ALLOWED_CLUSTER_HOSTS = KUSTO_CLOUDS.map((cloud) => cloud.hostSuffix).join(', ')
+
+function matchKustoCloud(host: string): (typeof KUSTO_CLOUDS)[number] | null {
+  return (
+    KUSTO_CLOUDS.find(
+      (cloud) => host === cloud.hostSuffix || host.endsWith(`.${cloud.hostSuffix}`)
+    ) ?? null
   )
 }
 
+/**
+ * Resolves the Entra authority that issues tokens for a cluster host. Callers
+ * pass a host already accepted by {@link checkAzureDataExplorerClusterUri}, so
+ * an unmatched host here means the two fell out of sync and is a bug, not input.
+ */
+export function resolveEntraAuthority(clusterHost: string): string {
+  const cloud = matchKustoCloud(clusterHost.toLowerCase())
+  if (!cloud) {
+    throw new Error(`No Microsoft Entra authority is configured for cluster host ${clusterHost}`)
+  }
+  return cloud.authority
+}
+
 export function checkAzureDataExplorerClusterUri(
   rawUrl: string,
   label = 'clusterUri'
@@ -45,10 +68,10 @@ export function checkAzureDataExplorerClusterUri(
   if (isPrivateIpHost(host)) {
     return { ok: false, message: `${label} host is not allowed (private/loopback range)` }
   }
-  if (!isAllowedKustoHost(host)) {
+  if (!matchKustoCloud(host)) {
     return {
       ok: false,
-      message: `${label} host must be an Azure Data Explorer or Fabric Eventhouse endpoint (${ALLOWED_CLUSTER_HOST_SUFFIXES.join(', ')})`,
+      message: `${label} host must be an Azure Data Explorer or Fabric Eventhouse endpoint (${ALLOWED_CLUSTER_HOSTS})`,
     }
   }
   return { ok: true, url: parsed }