In this article, I will share the reason why AADSTS50011 occurs, the exact byte-for-byte rules Entra ID uses during token requests, a step-by-step resolution, and how to prevent redirect URI drift in production enterprise environments.
Error AADSTS50011: The redirect URI specified in the request does not match the redirect URIs configured for the application..
This error is an identity firewall in action. Microsoft Entra ID (formerly Azure Active Directory) enforces strict OAuth 2.0, OpenID Connect (OIDC), and SAML validation rules to protect your organization from token interception attacks.
AADSTS50011
What Does Error AADSTS50011 Actually Mean?
At its core, AADSTS50011 indicates an authorization validation failure. When an application redirects a user to Microsoft Entra ID to authenticate, it passes a query parameter named redirect_uri (in OAuth/OIDC) or an AssertionConsumerServiceURL attribute (in SAML 2.0).
This parameter tells Microsoft’s identity provider where to send the user back—along with their authorization code, ID token, or SAML assertion—after sign-in succeeds.
Before Entra ID processes the sign-in request, it checks the incoming redirect_uri against the pre-approved list stored inside the application’s App Registration. If the incoming URI does not match an entry on that allowlist, Entra ID aborts the authentication attempt immediately and throws AADSTS50011.
The 5 Rules of Entra ID Redirect URI Validation
When Entra ID compares the incoming application request against the registered reply URLs, it performs an exact byte-for-byte string comparison. Understanding these comparison mechanics is key to troubleshooting:
- Exact Scheme/Protocol Matching:
http://andhttps://are treated as completely separate protocols. Requesting[http://app.azurelessons.com/callback](http://app.when the portal listsazurelessons.com/callback)[https://app.will fail.azurelessons.com/callback](https://app.azurelessons.com/callback) - Case Sensitivity on Paths: While domain names are case-insensitive per DNS standards, URL paths are case-sensitive in OAuth requests.
[https://app.does not matchazurelessons.com/Auth/Callback](https://app.azurelessons.com/Auth/Callback)[https://app..azurelessons.com/auth/callback](https://app.azurelessons.com/auth/callback) - Trailing Slash Sensitivity: A single slash at the end of the URL string breaks the match.
[https://app.andazurelessonsazurelessons[https://app.are unequal strings.azurelessonsazurelessons - Explicit Port Verification: Port numbers participate in the string evaluation.
http://localhost:3000/callbackwill not matchhttp://localhost:3001/callback. (Note: Forlocalhostloopback URIs in native app registrations, Entra ID allows dynamic ports, but for standard Web/SPA registrations, ports must match exactly). - No Wildcards for Confidential Clients: Entra ID strictly prohibits wildcard characters (like
https://*[.) for confidential clients and SPAs to prevent wildcard exploitation patterns.azurelessonsazurelessons
Why AADSTS50011 Happens
| Trigger Scenario | Operational Cause | Where the Fix Belongs |
|---|---|---|
| Missing Registration | The application environment (e.g., Staging) was deployed, but its URL was never added to Entra ID. | App Registration Portal |
| Protocol Drift behind Reverse Proxy | Load balancers/TLS terminators terminate HTTPS and forward HTTP to the app, causing the SDK to generate http:// redirect URIs. | App Code / Proxy Headers |
| Port Drift in Local Development | Dev server assigned a dynamic port (e.g., 3001 instead of 3000) because the default port was busy. | App Config / App Registration |
| Platform Type Mismatch | The URI was added under Web instead of Single-page application (SPA) or vice versa. | App Registration Portal |
| SAML ACS URL Mismatch | SAML AssertionConsumerServiceURL in the request does not match the SAML Reply URL in Enterprise Apps. | Enterprise Application SAML SSO |
| Trailing Slash Inconsistency | The authentication SDK appends a trailing / automatically during runtime. | App Registration / Code |
Step-by-Step Resolution Guide: How To Fix AADSTS50011
[ Step 1: Capture Error ] âž” [ Step 2: Extract Client ID ] âž” [ Step 3: Locate App ] âž” [ Step 4: Align URIs ]Step 1: Capture the Verbatim redirect_uri from the Error
Do not guess what URL your application sent. Look closely at the error screen or inspect the browser’s network trace.
Microsoft’s error screen displays both the exact URI sent and the Application (Client) ID.
- Copy the rejected URI verbatim from the error message.
- Copy the Application (Client) ID GUID listed on the screen.
Pro Tip: If the error screen masks the full URL, open your browser’s Developer Tools (F12), go to the Network tab, filter for
authorize, and inspect theredirect_uriquery string parameter in the outbound request URL.
Step 2: Locate the Target App Registration in Entra ID
- Log in to the Microsoft Entra Admin Center (
entra.microsoft.com) or Azure Portal (portal.azure.com) as an Application Developer, Cloud Application Administrator, or Global Administrator. - Expand Identity > Applications > App registrations.
- Select the All applications tab.
- Paste the Application (Client) ID you copied in Step 1 into the search filter and open the application.
Step 3: Audit and Update Platform Configurations
- In the left-hand navigation blade, click Authentication.
- Under Platform configurations, inspect the existing platform tiles (Web, Single-page application, or Mobile and desktop applications).
- Locate the platform matching your app architecture.
- Click Add URI under the corresponding platform block.
- Paste the exact string you captured from the error message in Step 1.
- Click Save at the top of the page.
Note: Entra ID usually updates configuration within seconds, but allow up to 3–5 minutes for full global propagation across edge locations.
Summary & Troubleshooting Checklist
AADSTS50011 is Entra ID’s defense mechanism against token theft. Whenever this error surfaces, run through this quick memory checklist:
- Extract: Grab the exact
redirect_uristring from the error page or browser Network tab. - Locate: Find the corresponding Client ID in Microsoft Entra ID > App registrations.
- Compare: Perform a byte-for-byte string check—verify protocol (
https), path casing, port numbers, and trailing slashes. - Update: Add the missing URI under the correct platform tile (Web, SPA, or Mobile/Desktop) and save.
You may also like the following articles:
I am Rajkishore, and I am a Microsoft Certified IT Consultant. I have over 14 years of experience in Microsoft Azure and AWS, with good experience in Azure Functions, Storage, Virtual Machines, Logic Apps, PowerShell Commands, CLI Commands, Machine Learning, AI, Azure Cognitive Services, DevOps, etc. Not only that, I do have good real-time experience in designing and developing cloud-native data integrations on Azure or AWS, etc. I hope you will learn from these practical Azure tutorials. Read more.
