AADSTS50011

In this article, I will share the reason why AADSTS50011 occurs, the exact byte-for-byte rules Entra ID uses during token requests, a step-by-step resolution, and how to prevent redirect URI drift in production enterprise environments.

Error AADSTS50011: The redirect URI specified in the request does not match the redirect URIs configured for the application..

This error is an identity firewall in action. Microsoft Entra ID (formerly Azure Active Directory) enforces strict OAuth 2.0, OpenID Connect (OIDC), and SAML validation rules to protect your organization from token interception attacks.

What Does Error AADSTS50011 Actually Mean?

At its core, AADSTS50011 indicates an authorization validation failure. When an application redirects a user to Microsoft Entra ID to authenticate, it passes a query parameter named redirect_uri (in OAuth/OIDC) or an AssertionConsumerServiceURL attribute (in SAML 2.0).

This parameter tells Microsoft’s identity provider where to send the user back—along with their authorization code, ID token, or SAML assertion—after sign-in succeeds.

Before Entra ID processes the sign-in request, it checks the incoming redirect_uri against the pre-approved list stored inside the application’s App Registration. If the incoming URI does not match an entry on that allowlist, Entra ID aborts the authentication attempt immediately and throws AADSTS50011.

The 5 Rules of Entra ID Redirect URI Validation

When Entra ID compares the incoming application request against the registered reply URLs, it performs an exact byte-for-byte string comparison. Understanding these comparison mechanics is key to troubleshooting:

Exact Scheme/Protocol Matching: http:// and https:// are treated as completely separate protocols. Requesting [http://app.azurelessons.com/callback](http://app.azurelessons.com/callback) when the portal lists [https://app.azurelessons.com/callback](https://app.azurelessons.com/callback) will fail.
Case Sensitivity on Paths: While domain names are case-insensitive per DNS standards, URL paths are case-sensitive in OAuth requests. [https://app.azurelessons.com/Auth/Callback](https://app.azurelessons.com/Auth/Callback) does not match [https://app.azurelessons.com/auth/callback](https://app.azurelessons.com/auth/callback).
Trailing Slash Sensitivity: A single slash at the end of the URL string breaks the match. [https://app.azurelessons.com/callback/](https://app.azurelessons.com/callback/) and [https://app.azurelessons.com/callback](https://app.azurelessons.com/callback) are unequal strings.
Explicit Port Verification: Port numbers participate in the string evaluation. http://localhost:3000/callback will not match http://localhost:3001/callback. (Note: For localhost loopback URIs in native app registrations, Entra ID allows dynamic ports, but for standard Web/SPA registrations, ports must match exactly).
No Wildcards for Confidential Clients: Entra ID strictly prohibits wildcard characters (like https://*[.azurelessons.com/callback](https://.azurelessons.com/callback)) for confidential clients and SPAs to prevent wildcard exploitation patterns.

Why AADSTS50011 Happens

Trigger Scenario	Operational Cause	Where the Fix Belongs
Missing Registration	The application environment (e.g., Staging) was deployed, but its URL was never added to Entra ID.	App Registration Portal
Protocol Drift behind Reverse Proxy	Load balancers/TLS terminators terminate HTTPS and forward HTTP to the app, causing the SDK to generate `http://` redirect URIs.	App Code / Proxy Headers
Port Drift in Local Development	Dev server assigned a dynamic port (e.g., 3001 instead of 3000) because the default port was busy.	App Config / App Registration
Platform Type Mismatch	The URI was added under Web instead of Single-page application (SPA) or vice versa.	App Registration Portal
SAML ACS URL Mismatch	SAML `AssertionConsumerServiceURL` in the request does not match the SAML Reply URL in Enterprise Apps.	Enterprise Application SAML SSO
Trailing Slash Inconsistency	The authentication SDK appends a trailing `/` automatically during runtime.	App Registration / Code

Step-by-Step Resolution Guide: How To Fix AADSTS50011

[ Step 1: Capture Error ] ➔ [ Step 2: Extract Client ID ] ➔ [ Step 3: Locate App ] ➔ [ Step 4: Align URIs ]

Step 1: Capture the Verbatim `redirect_uri` from the Error

Do not guess what URL your application sent. Look closely at the error screen or inspect the browser’s network