When I use a custom redirect URI such as schema://app, the application signs in without showing the DUO MFA prompt, and the user is logged in directly to the resource. Why no Conditional Access policy is applied ?

Question

When I use a custom redirect URI such as schema://app, the application signs in without showing the DUO MFA prompt, and the user is logged in directly to the resource. Why no Conditional Access policy is applied ?

SB 0

When I use a custom redirect URI such as schema://app, the application signs in without showing the DUO MFA prompt, and the user is logged in directly to the resource. In this flow, no Conditional Access policy is applied.

However, when I use the redirect URI as http://localhost, the DUO MFA prompt is displayed, and the Conditional Access policy is evaluated and enforced correctly.

How does Microsoft Entra ID evaluate Conditional Access policies based on the redirect URI, and why does the behavior differ between a custom URI scheme and http://localhost?

Rukmini 30,890 Reputation points Microsoft External Staff Moderator

2026-02-16T10:34:46.13+00:00

Hello SB,

http://localhost turns the application into a confidential client in Microsoft Entra ID. This implies that client_secret (or certificate) must be included in the /token request.

This is what the 401 Unauthorized error means: During token redemption, client authentication was unsuccessful.

The problem is not with Conditional Access. Include the client_secret and let me know if it works!
Rukmini 30,890 Reputation points Microsoft External Staff Moderator

2026-02-18T09:29:35.21+00:00

Hello SB, Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 30,890 Reputation points Microsoft External Staff Moderator

2026-02-16T10:34:46.13+00:00

Hello SB,

http://localhost turns the application into a confidential client in Microsoft Entra ID. This implies that client_secret (or certificate) must be included in the /token request.

This is what the 401 Unauthorized error means: During token redemption, client authentication was unsuccessful.

The problem is not with Conditional Access. Include the client_secret and let me know if it works!
Rukmini 30,890 Reputation points Microsoft External Staff Moderator

2026-02-18T09:29:35.21+00:00

Hello SB, Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

Andy David - MVP 159.9K MVP Volunteer Moderator

That signals to Entra that its a public client:

https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/confidential-client-application-authentication-error-aadsts7000218

and Policies arent evaluated against public clients, they are against the resource you trying to access with that client

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps?tabs=powershell

User's image

SB 0 Reputation points

2026-02-11T06:10:15.7233333+00:00

Thanks @Andy David - MVP for the clarification, found this https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/confidential-client-application-authentication-error-aadsts7000218#how-microsoft-entra-id-determines-the-client-type helpful. So Entra ID determines the client type by redirect-URI.
I tried to use http://localhost as redirect-URI and it shows the DUO prompt now (Conditional Access policy applied successfully) but after getting the auth code when it tries to redeem the code to get the access_token it throws below error
"errors": [

    {

      "cause": null,

      "code": "IDP_ERROR",

      "detail": "401 Unauthorized from POST https://login.microsoftonline.com/abcd/oauth2/v2.0/token",

      "domain": “XYZ”,

      "message": "Error calling identity provider",

      "parameters": {},

      "severity": null,

      "timestampInUtc": “—“

    }

  ],

  "resource": "/auth/v1/token",

  "status": 401,

  "traceId": “xyzabcd”

}
Is Entra ID expecting any additional parameters in the token request when using http://localhost as the redirect URI? What exactly does this 401 error indicate in this scenario?

Thanks

Share via

When I use a custom redirect URI such as schema://app, the application signs in without showing the DUO MFA prompt, and the user is logged in directly to the resource. Why no Conditional Access policy is applied ?

1 answer

Your answer