Azure Front Door custom domain with Power Pages causing ExternalAuthenticationFailed during Azure AD login

Hello @ Sumayyah Shamsudeen,

Thanks for reaching out to Microsoft Q&A.

If the custom domain is configured only in Azure Front Door, Microsoft Power Pages will continue to recognize and use the default *.powerappsportals.com domain. As a result, the authentication request generates the redirect_uri with the default domain, which can lead to authentication failures when users access the site through the custom subdomain.

To resolve this issue, the custom domain must also be configured directly in Power Pages. Once the domain is registered there, Power Pages will recognize it as a valid hostname and generate the correct redirect_uri using the custom domain. Azure Front Door can still be used as the entry point with managed TLS; however, the domain must also exist in Power Pages for authentication to work properly.

The custom domain should be configured in both locations:

On the Power Pages site

On Azure Front Door

This configuration ensures that cookies and site URLs are generated correctly for the custom domain. The custom domain should first be added in Power Pages so the portal recognizes the hostname, after which DNS can be configured to point the CNAME record to the Front Door endpoint.

Reference Document:

https://learn.microsoft.com/en-us/power-pages/configure/azure-front-door

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Thank you for the clarification @Ravi Varma Mudduluru

That explanation about Power Pages needing to recognize the custom domain for generating the correct redirect_uri is helpful.

However, when I attempt to configure the custom domain directly in Power Pages using Connect custom domain, the portal requires me to upload an SSL certificate manually. My initial goal in introducing Azure Front Door was to avoid manual certificate management and instead use the managed TLS certificate provided by Azure Front Door, which automatically handles renewal.

This raised a few follow-up questions for me:

If I configure the custom domain in both Power Pages and Azure Front Door, does that mean there will effectively be two SSL certificates for the same domain (one uploaded in Power Pages and one managed by Front Door)?

Is it possible for Power Pages to use the managed TLS certificate from Azure Front Door, or must a certificate always be uploaded manually when connecting a custom domain in Power Pages?

If manual certificate upload is required in Power Pages, what is the recommended way to automate certificate renewal so that the certificate does not need to be manually replaced every time it expires?

My main objective is to ensure the portal works correctly with the custom domain while also avoiding manual certificate renewal and upload if possible.

Any guidance on the recommended approach for automating this setup would be greatly appreciated.

Hello @ Sumayyah Shamsudeen,

1. However, when I attempt to configure the custom domain directly in Power Pages using Connect custom domain, the portal requires me to upload an SSL certificate manually. My initial goal in introducing Azure Front Door was to avoid manual certificate management and instead use the managed TLS certificate provided by Azure Front Door, which automatically handles renewal.

If you choose the certificate type as AFD managed, the certificate will be renewed automatically.

Reference:

https://learn.microsoft.com/en-us/azure/frontdoor/standard-premium/how-to-add-custom-domain

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Thank you for the response @Ravi Varma Mudduluru

I understand that when configuring a custom domain in Azure Front Door, selecting AFD managed certificate allows the TLS certificate to be issued and renewed automatically. That part of the configuration has already been completed successfully on my side.

My confusion is related to the Power Pages configuration step you mentioned earlier when you said that “the custom domain must also be configured directly in Power Pages so that it is recognized as a valid hostname.”

When I go to Power Platform Admin Center → Power Pages site(Private site) → Connect custom domain, the portal asks me to upload an SSL certificate manually for the custom domain. Here's the screenshot attached:

This appears to be a separate certificate requirement from the AFD managed TLS certificate that is already configured in Azure Front Door.

Currently the setup is:

• Custom domain added and validated in Azure Front Door
• AFD managed TLS certificate enabled for the custom domain
• DNS configured so the subdomain resolves to the Front Door endpoint
• Redirect URIs for the custom domain added in Azure AD App Registration

When accessing the custom domain, the request flows through Azure Front Door and an intermediate authentication URL appears similar to:

https://login.microsoftonline.com/<tenant-id>/oauth2/authorize?...&redirect_uri=https://<powerpages-default-domain>/

After authentication, the portal redirects to:

https://<portal>.powerappsportals.com/Account/Login/ExternalAuthenticationFailed

Ideally the login flow should return to something like:

https://<custom-domain>/SignIn?ReturnUrl=%2F

So I want to clarify the following:

1. When you say the custom domain must also be configured in Power Pages, are you referring specifically to the “Connect custom domain” step in the Power Platform Admin Center?
2. If so, does that mean a separate SSL certificate must always be uploaded in Power Pages, even when Azure Front Door already has a managed TLS certificate for the same domain?
3. Is there any supported way for Power Pages to use the Azure Front Door managed certificate, or must the certificate always be managed separately in Power Pages?

Additionally, if configuring the custom domain inside Power Pages is not required, could you please clarify what additional configuration might be needed to resolve the ExternalAuthenticationFailed issue, given that the DNS, routing, and Azure Front Door setup are already functioning correctly?

My main goal is to ensure the custom domain works correctly with authentication while avoiding manual certificate upload and renewal if possible.