How to Fix Error AADSTS50011 in Microsoft Entra ID (Redirect URI Mismatch)

#azure #entra #oauth #webdev

📖 Original Reference: Originally published with interactive diagrams and enterprise identity baselines at alexmaina.dev/entra-id-redirect-uri-aadsts50011.

If you are developing applications using MSAL (Microsoft Authentication Library) and Microsoft Entra ID (formerly Azure AD), you have likely run into this frustrating blocker:

AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application '{client-id}'.

This error appears during the OAuth 2.0 / OpenID Connect authorization handshake. Microsoft's token endpoint performs a strict character-by-character validation, meaning even a single trailing slash or port mismatch will immediately halt authentication.

Here is how to diagnose the root cause and fix it in under 3 minutes.

1. The 4 Most Common Causes of Mismatch

Root Cause	What MSAL Request Sends	What Entra ID App Has Configured
Trailing Slash	`http://localhost:3000`	`http://localhost:3000/`
Protocol Scheme	`https://app.mydomain.com/callback`	`http://app.mydomain.com/callback`
Dynamic Dev Port	`http://localhost:5173` (Vite)	`http://localhost:3000` (Create-React-App)
Wrong Platform Type	SPA with PKCE (CORS)	Configured under "Web" section

2. Step-by-Step Fix via Microsoft Entra Admin Center

Navigate to the Microsoft Entra Admin Center.
Go to Identity → Applications → App registrations.
Select the All applications tab and open your registered application (match the client-id from your error log).
In the left navigation menu, click Authentication.
Inspect your platform configuration:
- Single-Page Application (SPA): If you are using React, Vue, Angular, or vanilla JS with MSAL Browser (Auth Code flow with PKCE), your URI MUST be under the Single-page application section. If registered under "Web", token requests will fail due to missing CORS headers.
- Web: Use this only for backend-rendered apps with client secrets (Next.js server-side, Node/Express, Django, Flask, ASP.NET Core).
- Mobile and desktop applications: Required for CLI tools, PowerShell, Python scripts, or desktop apps using loopback listeners (http://localhost).
Paste the exact Redirect URI from the error message.
Click Save at the top.

3. Fast Fix with Microsoft Graph PowerShell

If you frequently rotate ports during local testing, you can update redirect URIs programmatically using the official Microsoft Graph PowerShell SDK:

# Authenticate to Microsoft Graph
Connect-MgGraph -Scopes "Application.ReadWrite.All"

$AppId = "YOUR-APPLICATION-CLIENT-ID"
$App = Get-MgApplication -Filter "appId eq '$AppId'"

# Configure allowed redirect URIs for local dev + production
$SpaRedirects = @(
    "http://localhost:3000",
    "http://localhost:5173",
    "https://alexmaina.dev/auth/callback"
)

# Update SPA Platform configuration
Update-MgApplication -ApplicationId $App.Id -Spa @{ RedirectUris = $SpaRedirects }

Write-Host "✅ Redirect URIs successfully updated for: $($App.DisplayName)" -ForegroundColor Green

4. Crucial Rules for Localhost in Entra ID

HTTP is strictly reserved for Localhost: Microsoft Entra ID enforces HTTPS for all production domain redirect URIs. The only exception is loopback addresses (http://localhost or http://127.0.0.1).
Wildcards are deprecated: Microsoft no longer allows wildcard characters (*) in redirect URIs for security reasons (preventing token interception and open-redirect attacks). Each callback endpoint must be explicitly declared.

Need Deep Dive Architecture?

For full zero-trust setups, enterprise RBAC baselines, and tenant isolation, check out my technical guide hub at alexmaina.dev.

Author: Alessandro Mainardi — Software Developer & Computer Engineering Student @ Alma Mater Studiorum - University of Bologna.

DEV Community