diff --git a/msal/authority.py b/msal/authority.py
index 689ea8c..51289d2 100644
--- a/msal/authority.py
+++ b/msal/authority.py
@@ -1,10 +1,12 @@
 import re
+import logging
 
 import requests
 
 from .exceptions import MsalServiceError
 
 
+logger = logging.getLogger(__name__)
 WORLD_WIDE = 'login.microsoftonline.com'  # There was an alias login.windows.net
 WELL_KNOWN_AUTHORITY_HOSTS = set([
     WORLD_WIDE,
@@ -38,7 +40,7 @@ class Authority(object):
         canonicalized, self.instance, tenant = canonicalize(authority_url)
         tenant_discovery_endpoint = (  # Hard code a V2 pattern as default value
             'https://{}/{}/v2.0/.well-known/openid-configuration'
-            .format(WORLD_WIDE, tenant))
+            .format(self.instance, tenant))
         if validate_authority and self.instance not in WELL_KNOWN_AUTHORITY_HOSTS:
             tenant_discovery_endpoint = instance_discovery(
                 canonicalized + "/oauth2/v2.0/authorize",
@@ -46,6 +48,7 @@ class Authority(object):
         openid_config = tenant_discovery(
             tenant_discovery_endpoint,
             verify=verify, proxies=proxies, timeout=timeout)
+        logger.debug("openid_config = %s", openid_config)
         self.authorization_endpoint = openid_config['authorization_endpoint']
         self.token_endpoint = openid_config['token_endpoint']
         _, _, self.tenant = canonicalize(self.token_endpoint)  # Usually a GUID
@@ -76,7 +79,11 @@ def canonicalize(url):
 def instance_discovery(url, response=None, **kwargs):
     # Returns tenant discovery endpoint
     resp = requests.get(  # Note: This URL seemingly returns V1 endpoint only
-        'https://{}/common/discovery/instance'.format(WORLD_WIDE),
+        'https://{}/common/discovery/instance'.format(
+            WORLD_WIDE  # Historically using WORLD_WIDE. Could use self.instance too
+                # See https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/4.0.0/src/Microsoft.Identity.Client/Instance/AadInstanceDiscovery.cs#L101-L103
+                # and https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/4.0.0/src/Microsoft.Identity.Client/Instance/AadAuthority.cs#L19-L33
+            ),
         params={'authorization_endpoint': url, 'api-version': '1.0'},
         **kwargs)
     payload = response or resp.json()

support: sovereign cloud 
[This line](https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/dev/msal/authority.py#L41) by hard coding to public azure blocks authentication in sovereign clouds. Please fix it soon

//CC @marstr @rayluo 
diff --git a/tests/test_authority.py b/tests/test_authority.py
index 4171455..d7fc5ca 100644
--- a/tests/test_authority.py
+++ b/tests/test_authority.py
@@ -4,24 +4,16 @@ from tests import unittest
 
 
 class TestAuthority(unittest.TestCase):
-    COMMON_AUTH_ENDPOINT = \
-        'https://login.microsoftonline.com/common/oauth2/v2.0/authorize'
-    COMMON_TOKEN_ENDPOINT = \
-        'https://login.microsoftonline.com/common/oauth2/v2.0/token'
 
     def test_wellknown_host_and_tenant(self):
-        # Test one specific sample in straightforward way, for readability
-        a = Authority('https://login.microsoftonline.com/common')
-        self.assertEqual(a.authorization_endpoint, self.COMMON_AUTH_ENDPOINT)
-        self.assertEqual(a.token_endpoint, self.COMMON_TOKEN_ENDPOINT)
-
-        # Test all well known authority hosts, using same real "common" tenant
+        # Assert all well known authority hosts are using their own "common" tenant
         for host in WELL_KNOWN_AUTHORITY_HOSTS:
             a = Authority('https://{}/common'.format(host))
-            # Note: this "common" tenant endpoints always point to its real host
             self.assertEqual(
-                a.authorization_endpoint, self.COMMON_AUTH_ENDPOINT)
-            self.assertEqual(a.token_endpoint, self.COMMON_TOKEN_ENDPOINT)
+                a.authorization_endpoint,
+                'https://%s/common/oauth2/v2.0/authorize' % host)
+            self.assertEqual(
+                a.token_endpoint, 'https://%s/common/oauth2/v2.0/token' % host)
 
     @unittest.skip("As of Jan 2017, the server no longer returns V1 endpoint")
     def test_lessknown_host_will_return_a_set_of_v1_endpoints(self):
@@ -33,20 +25,12 @@ class TestAuthority(unittest.TestCase):
         self.assertEqual(a.token_endpoint, v1_token_endpoint)
         self.assertNotIn('v2.0', a.token_endpoint)
 
-    def test_unknown_host(self):
+    def test_unknown_host_wont_pass_instance_discovery(self):
         with self.assertRaisesRegexp(MsalServiceError, "invalid_instance"):
             Authority('https://unknown.host/tenant_doesnt_matter_in_this_case')
 
-    def test_unknown_host_valid_tenant_and_skip_host_validation(self):
-        # When skipping host (a.k.a. instance) validation,
-        # the Tenant Discovery will always use WORLD_WIDE service as instance,
-        # so, if the tenant happens to exist there, it will find some endpoints.
-        a = Authority('https://incorrect.host/common', validate_authority=False)
-        self.assertEqual(a.authorization_endpoint, self.COMMON_AUTH_ENDPOINT)
-        self.assertEqual(a.token_endpoint, self.COMMON_TOKEN_ENDPOINT)
-
-    def test_unknown_host_unknown_tenant_and_skip_host_validation(self):
-        with self.assertRaisesRegexp(MsalServiceError, "invalid_tenant"):
+    def test_invalid_host_skipping_validation_meets_connection_error_down_the_road(self):
+        with self.assertRaises(requests.exceptions.RequestException):
             Authority('https://unknown.host/invalid', validate_authority=False)
 
 

pip install -e .
parse_log_pytest
pytest
pytest
3.6
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs @ file:///opt/conda/conda-bld/attrs_1642510447205/work
certifi==2021.5.30
cffi==1.15.1
charset-normalizer==2.0.12
cryptography==40.0.2
idna==3.10
importlib-metadata @ file:///tmp/build/80754af9/importlib-metadata_1631916693255/work
iniconfig @ file:///home/linux1/recipes/ci/iniconfig_1610983019677/work
more-itertools @ file:///tmp/build/80754af9/more-itertools_1637733554872/work
-e git+https://github.com/AzureAD/microsoft-authentication-library-for-python.git@4c5245836452bc9331b1a992ebe70ecdf9afd737#egg=msal
packaging @ file:///tmp/build/80754af9/packaging_1637314298585/work
pluggy @ file:///tmp/build/80754af9/pluggy_1615976315926/work
py @ file:///opt/conda/conda-bld/py_1644396412707/work
pycparser==2.21
PyJWT==1.7.1
pyparsing @ file:///tmp/build/80754af9/pyparsing_1635766073266/work
pytest==6.2.4
requests==2.27.1
toml @ file:///tmp/build/80754af9/toml_1616166611790/work
typing_extensions @ file:///opt/conda/conda-bld/typing_extensions_1647553014482/work
urllib3==1.26.20
zipp @ file:///tmp/build/80754af9/zipp_1633618647012/work

name: microsoft-authentication-library-for-python
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - attrs=21.4.0=pyhd3eb1b0_0
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - importlib-metadata=4.8.1=py36h06a4308_0
  - importlib_metadata=4.8.1=hd3eb1b0_0
  - iniconfig=1.1.1=pyhd3eb1b0_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - more-itertools=8.12.0=pyhd3eb1b0_0
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - packaging=21.3=pyhd3eb1b0_0
  - pip=21.2.2=py36h06a4308_0
  - pluggy=0.13.1=py36h06a4308_0
  - py=1.11.0=pyhd3eb1b0_0
  - pyparsing=3.0.4=pyhd3eb1b0_0
  - pytest=6.2.4=py36h06a4308_2
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - toml=0.10.2=pyhd3eb1b0_0
  - typing_extensions=4.1.1=pyh06a4308_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zipp=3.6.0=pyhd3eb1b0_0
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - cffi==1.15.1
      - charset-normalizer==2.0.12
      - cryptography==40.0.2
      - idna==3.10
      - pycparser==2.21
      - pyjwt==1.7.1
      - requests==2.27.1
      - urllib3==1.26.20
prefix: /opt/conda/envs/microsoft-authentication-library-for-python

tests/test_authority.py::TestAuthority::test_invalid_host_skipping_validation_meets_connection_error_down_the_road
tests/test_authority.py::TestAuthority::test_wellknown_host_and_tenant
tests/test_authority.py::TestAuthority::test_unknown_host_wont_pass_instance_discovery tests/test_authority.py::TestAuthorityInternalHelperCanonicalize::test_canonicalize_rejects_non_https tests/test_authority.py::TestAuthorityInternalHelperCanonicalize::test_canonicalize_rejects_tenantless tests/test_authority.py::TestAuthorityInternalHelperCanonicalize::test_canonicalize_rejects_tenantless_host_with_trailing_slash tests/test_authority.py::TestAuthorityInternalHelperCanonicalize::test_canonicalize_tenant_followed_by_extra_fragment tests/test_authority.py::TestAuthorityInternalHelperCanonicalize::test_canonicalize_tenant_followed_by_extra_paths tests/test_authority.py::TestAuthorityInternalHelperCanonicalize::test_canonicalize_tenant_followed_by_extra_query tests/test_authority.py::TestAuthorityInternalHelperInstanceDiscovery::test_instance_discovery_happy_case tests/test_authority.py::TestAuthorityInternalHelperInstanceDiscovery::test_instance_discovery_with_mocked_response tests/test_authority.py::TestAuthorityInternalHelperInstanceDiscovery::test_instance_discovery_with_unknown_instance
msal/authority.py
msal/authority.py