Issue with Send-MgUserMail command in GCC High

[SamRobinson83]

Describe the bug

I have several automated tasks that when they are finished use the Send-MgUserMail functionality to send alerts. We migrated away from Commercial to GCC High at the end of last year and now the Send-MgUserMail command throws an error when trying to send. The error is the following:

Send-MgUserMail -UserId $userId -BodyParameter $params -Debug
     |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Remote forest discovery is not supported on restricted forests. Local Forest: NAMP111.PROD.OUTLOOK.COM Remote
     | Forest: NAMP110A003.PROD.OUTLOOK.COM.  Status: 403 (Forbidden) ErrorCode:
     | ErrorTenantNotFoundInCurrentSovereignEnvironment Date:   Headers: Cache-Control                 : private
     | Strict-Transport-Security     : max-age=31536000 request-id                    :
     | 23b60610-8afc-4683-9889-a7365793f1d1 client-request-id             : 865d4788-72d4-417f-99b5-606404ea9872
     | x-ms-ags-diagnostic           : {"ServerInfo":{"DataCenter":"USDoD
     | East","Slice":"E","Ring":"6","ScaleUnit":"000","RoleInstance":"BN3NEPF00005473"}} Date
     | : Wed, 25 Mar 2026 18:26:43 GMT

  Recommendation: See service error codes: https://learn.microsoft.com/graph/errors

Expected behavior

Send-MgUserMail sending an email to the intended users email.

How to reproduce

1. Connect to GCC High via Graph Powershell
2. Use the Send-MgUserMail command to send a message

SDK Version

2.36.1

Latest version known to work for scenario above?

No response

Known Workarounds

None

Debug output

Click to expand log

```

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://dod-graph.microsoft.us/v1.0/users/noreply%40vanguard-ems.us/microsoft.graph.sendMail

Headers:
FeatureFlag : 00000003
Cache-Control : no-store, no-cache
User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.26200; en-US),PowerShell/7.5.4
SdkVersion : graph-powershell/2.36.1
client-request-id : 865d4788-72d4-417f-99b5-606404ea9872
Accept-Encoding : gzip,deflate,br

Body:
{
"Message": {
"subject": "Testing MG Graph Stuffs",
"toRecipients": [
{
"emailAddress": {
"address": "user@domain"
}
}
],
"body": {
"content": "Testing email.",
"contentType": "Text"
}
}
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Forbidden

Headers:
Cache-Control : private
Strict-Transport-Security : max-age=31536000
request-id : 23b60610-8afc-4683-9889-a7365793f1d1
client-request-id : 865d4788-72d4-417f-99b5-606404ea9872
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"USDoD East","Slice":"E","Ring":"6","ScaleUnit":"000","RoleInstance":"BN3NEPF00005473"}}
Date : Wed, 25 Mar 2026 18:26:43 GMT

Body:
{
"error": {
"code": "ErrorTenantNotFoundInCurrentSovereignEnvironment",
"message": "Remote forest discovery is not supported on restricted forests. Local Forest: NAMP111.PROD.OUTLOOK.COM Remote Forest: NAMP110A003.PROD.OUTLOOK.COM."
}
}

Send-MgUserMail_Send: C:\Scripts\Email.ps1:19
Line |
19 | Send-MgUserMail -UserId $userId -BodyParameter $params -Debug
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Remote forest discovery is not supported on restricted forests. Local Forest: NAMP111.PROD.OUTLOOK.COM Remote
| Forest: NAMP110A003.PROD.OUTLOOK.COM. Status: 403 (Forbidden) ErrorCode:
| ErrorTenantNotFoundInCurrentSovereignEnvironment Date: Headers: Cache-Control : private
| Strict-Transport-Security : max-age=31536000 request-id :
| 23b60610-8afc-4683-9889-a7365793f1d1 client-request-id : 865d4788-72d4-417f-99b5-606404ea9872
| x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"USDoD
| East","Slice":"E","Ring":"6","ScaleUnit":"000","RoleInstance":"BN3NEPF00005473"}} Date
| : Wed, 25 Mar 2026 18:26:43 GMT

Recommendation: See service error codes: https://learn.microsoft.com/graph/errors
DEBUG: [CmdletEndProcessing]: - Send-MgUserMail end processing.

</details>


### Configuration

-OS: Windows 11
-Architecture: x64
-Powershell: 7.6

### Other information

_No response_

[SamRobinson83]

I have also tried versions all the way back to 2.13.0 and the issue persists. I did not try any prior to that.

[ramsessanchez]

Hi @SamRobinson83, could you share the full code snippet that you are using for this script. It looks like you are using the DOD graph endpoint, which is stricter than the standard gcc high endpoint; https://graph.microsoft.us vs https://dod-graph.microsoft.us.

[SamRobinson83]

Sorry was out of the office for a few days. Here is the code:

[xml]$config = Get-Content "C:\Scripts\conf.xml"

$TenantId = $config.Values.TID
$ApplicationId = $config.Values.AID
$ClientSecretValue = $config.Values.SID
# Convert the client secret to a secure string
$pass = ConvertTo-SecureString -String $ClientSecretValue -AsPlainText -Force
# Create a credential object using the client ID and secure string
$cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $ApplicationId, $pass
# Connect to Microsoft Graph with Client Secret
Connect-MgGraph -TenantId $TenantId -ClientSecretCredential $cred -Environment 'USGovDoD'

$userId = "noreply@domain"
$params = @{
	message = @{
		subject = "Testing MG Graph Stuffs"
		body = @{
			contentType = "Text"
			content = "Testing email."
		}
		toRecipients = @(
			@{
				emailAddress = @{
					address = "recipient@domain"
				}
			}
		)
	}
}

Send-MgUserMail -UserId $userId -BodyParameter $params

[ramsessanchez]

@SamRobinson83 looks like you're using the UsGovDoD environment, this could be the reason why you are seeing issues connecting if you do not have the adequate permissions. In your first comment you mentioned you had migrated to GCC-High which is less privileged. Could you try changing the Connect-MgGraph environment to UsGov instead of UsGovDoD. Let me know if this issue persists.

[SamRobinson83]

That was the issue, I had read in documentation that it was supposed to be "UsGovDoD" for the environment but yes changing it to UsGov made it work.