@@ -29,7 +29,7 @@ Sim requests these scopes when someone connects a Power BI account. For a self-h
 
 ## Use the block [#usage-instructions]
 
-Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. A Microsoft Graph connection cannot substitute for the Power BI connection or app credential. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.
+Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential in the global cloud, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. A Microsoft Graph connection cannot substitute for the Power BI connection or app credential. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.
 
 ## Actions
 
 
@@ -75,6 +75,11 @@ export function useKeylessSetup<P extends WorkloadIdentityProvider>({
     reconnectAuthType,
     /** A reconnected Microsoft app credential's national cloud; a reconnect reopens on it. */
     reconnectCloud: setup.data?.reconnectCloud,
+    /**
+     * Whether the reconnect fields above came back. False while they load, after a failed
+     * lookup, and for an organization credential, whose stored secret this lookup never reads.
+     */
+    reconnectFieldsLoaded: workspaceScoped && setup.isSuccess,
     isReconnect: Boolean(credentialId),
     subjectChoice,
     setSubjectChoice,
 
@@ -108,10 +108,15 @@ function MicrosoftAppAccountForm({
       ? 'federated'
       : 'client_secret'
   const authType: MicrosoftAuthType = selectedAuthType ?? defaultAuthType
-  // A reconnect also opens on the credential's stored cloud.
-  const cloud: MicrosoftCloudId = selectedCloud ?? keyless.reconnectCloud ?? 'global'
+  // A reconnect opens on the credential's stored cloud. Until that is known (still loading, a
+  // failed lookup, or an organization credential) the cloud must be chosen, so a rotation never
+  // silently moves a national-cloud credential to the global cloud.
+  const storedCloudKnown = !credentialId || keyless.reconnectFieldsLoaded
+  const cloud: MicrosoftCloudId | undefined =
+    selectedCloud ?? (storedCloudKnown ? (keyless.reconnectCloud ?? 'global') : undefined)
   const disabled =
     isPending ||
+    !cloud ||
     !tenantId.trim() ||
     !clientId.trim() ||
     (authType === 'client_secret' && !clientSecret.trim()) ||
@@ -123,13 +128,13 @@ function MicrosoftAppAccountForm({
     clearError()
   }
 
-  const buildConfig = (): Record<string, unknown> => {
-    const isGlobal = cloud === 'global'
+  const buildConfig = (appCloud: MicrosoftCloudId): Record<string, unknown> => {
+    const isGlobal = appCloud === 'global'
     const base = {
       authType,
       tenantId: tenantId.trim(),
       clientId: clientId.trim(),
-      ...(isGlobal ? {} : { cloud }),
+      ...(isGlobal ? {} : { cloud: appCloud }),
       ...(isGlobal && environmentUrl.trim() ? { environmentUrl: environmentUrl.trim() } : {}),
     }
     if (authType === 'federated') return { ...base, ...keylessSubjectFields(keyless) }
@@ -178,6 +183,7 @@ function MicrosoftAppAccountForm({
             clearError()
           }}
           options={CLOUD_OPTIONS}
+          placeholder='Choose the app’s cloud'
           required
           hint='The Microsoft cloud the app is registered in. Only Azure Data Explorer runs outside the global cloud.'
         />
@@ -287,7 +293,9 @@ function MicrosoftAppAccountForm({
         primaryAction={{
           label: isPending ? 'Verifying...' : `${action} credential`,
           onClick: () => {
-            if (!disabled) void submit({ config: buildConfig(), displayName, description })
+            if (!disabled && cloud) {
+              void submit({ config: buildConfig(cloud), displayName, description })
+            }
           },
           disabled,
         }}
 
@@ -25,7 +25,7 @@ export const PowerBIBlock: BlockConfig = {
   type: 'powerbi',
   name: 'Power BI',
   description: 'Query semantic models and manage reports and refreshes',
-  longDescription: `Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. A Microsoft Graph connection cannot substitute for the Power BI connection or app credential. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.`,
+  longDescription: `Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential in the global cloud, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. A Microsoft Graph connection cannot substitute for the Power BI connection or app credential. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.`,
   docsLink: 'https://docs.sim.ai/integrations/powerbi',
   category: 'tools',
   integrationType: IntegrationType.Analytics,
 
@@ -219,6 +219,26 @@ describe('running an Azure Data Explorer tool', () => {
       )
     })
 
+    it('refuses a resource override in another cloud than the cluster before decrypting', async () => {
+      storeAppCredential()
+
+      const response = await run(
+        {
+          clusterUri: CLUSTER,
+          resource: 'https://mycluster.usgovvirginia.kusto.usgovcloudapi.net',
+        },
+        authorized
+      )
+
+      expect(response.status).toBe(400)
+      await expect(response.json()).resolves.toMatchObject({
+        error: expect.stringMatching(/same Microsoft cloud/),
+      })
+      expect(encryptionMockFns.mockDecryptSecret).not.toHaveBeenCalled()
+      expect(entra).not.toHaveBeenCalled()
+      expect(secureFetch).not.toHaveBeenCalled()
+    })
+
     it('refuses a host outside the Kusto allowlist without minting', async () => {
       const response = await run({ clusterUri: 'https://evil.example.com' }, authorized)
 
 
@@ -125,6 +125,19 @@ function refineHosts(
       path: ['resource'],
       message: resourceCheck.message,
     })
+    return
+  }
+  if (!clusterCheck.ok) return
+  const clusterClouds = kustoCredentialClouds(clusterCheck.url.hostname)
+  const sharesCloud = kustoCredentialClouds(resourceCheck.url.hostname).some((cloud) =>
+    clusterClouds.includes(cloud)
+  )
+  if (!sharesCloud) {
+    context.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['resource'],
+      message: 'resource must be in the same Microsoft cloud as clusterUri',
+    })
   }
 }
 
 
@@ -21622,7 +21622,7 @@
       "slug": "power-bi",
       "name": "Power BI",
       "description": "Query semantic models and manage reports and refreshes",
-      "longDescription": "Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. A Microsoft Graph connection cannot substitute for the Power BI connection or app credential. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.",
+      "longDescription": "Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential in the global cloud, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. A Microsoft Graph connection cannot substitute for the Power BI connection or app credential. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.",
       "bgColor": "#FFFFFF",
       "iconName": "PowerBIIcon",
       "docsUrl": "https://docs.sim.ai/integrations/powerbi",