AADSTS501201: Unexpected claim(s) in JWT: client_id,redirect_uri.

Question

Hello,

I have an authentication issue on a Hybrid joined Windows 11 computer.

This a Citrix VDI where users are automatically signed in Office apps and Edge.

But when authenticating to Office365 from Edge, they get that outstanding issue right before being prompted for password or anything:

The error code is not referenced at Microsoft.

Also I have no sign-in logs at all in Azure.

Does someone has an idea on where I should start to troubleshoot this?

Thanks in advance.

Answer 1

We're having the same issue on a few machines. On the computers experiencing the issue, I can confirm:

• an incognito/private browser window lets the user sign in successfully
• uninstalling KB5028185 fixes it

However, at present, not every computer with KB5028185 installed appears to be affected.

Answer 2

I had the same and managed to resolve it.

I could log in ok with Edge InPrivate but not in my normal user Edge profile, so figured the issue was with the session.

1. Signed out of Edge browser (icon top right)
2. Browse to an MS site and login. I used https://myapplications.microsoft.com/#
3. Then back to the profile icon in Edge and clicked 'signin to sync'

Its all good after that.

If you have the issue with multiple users, a forced sign out of everything might help to resolve.

Answer 3

I tried signing out and logging in. Then enable the sync again. Works for a while but got the same message at some point. Uninstalling KB5028185 fixes it for me.

Answer 4

We have been able to remedy this after some extensive troubleshooting. We are in a Hybrid environment. We saw a correlation between devices with KB5028185 and also stuck in "Pending" registration in AAD. That led us to the Azure PRT not being able to renew. To remedy this, we unregister the device, delete the device in AAD, sync from our on-prem AD.

1. We unregister the device in command prompt dsregcmd /leave
2. Delete the device in AAD
3. Sync from our on-prem AD
4. Wait until the device appears in AAD with the status of pending
5. Restart the device
6. Sign into our APP/VPN, (SSO)
7. If the device does not become registered run the "Automatic Device Join" scheduled task under Microsoft>Windows>Workplace Join
8. Verify the device has registered
9. Run dsregcmd /status and check the AzureAdPRT for validity under SSO State.

After completing these steps, we had no issues with KB5028185 being installed.

References we used:

https://learn.microsoft.com/en-us/answers/questions/1161747/hybrid-azure-ad-joined-device-registration-pending

https://samilamppu.com/2020/01/16/azure-ad-hybrid-device-join-hdj-status-pending/

https://ulyssesneves.com/2022/06/02/device-registration-investigating-error-message-deviceauthstatus-failed-device-is-either-disabled-or-deleted/