We are having some issues with the built in auth for static web apps - it only affects apps deployed in the last 48 hours

Question

We are having some issues with the built in auth for static web apps - it only affects apps deployed in the last 48 hours

Steven Culshaw 50

It appears that newer deployments are redirecting to https://identity.7.azurestaticapps.net/.auth/login/aad/callback and this in turn is returning a 401.

Older deployments are redirecting to https://identity.4.azurestaticapps.net/.auth/login/aad/callback these are still working ok.

Praneeth Maddali 9,115 Reputation points Microsoft External Staff Moderator

2026-04-15T09:58:11.22+00:00

Hi @Steven Culshaw

Thank you for contacting us about the some issues with the built in auth for static web apps issue. We have begun looking into it and will share our suggestions with you as soon as possible. If you have any additional details or concerns in the meantime, please let us know. We appreciate your patience while we work on this.
Steven Culshaw 50 Reputation points

2026-04-15T11:05:54.3833333+00:00

Thanks @Praneeth Maddali
Praneeth Maddali 9,115 Reputation points Microsoft External Staff Moderator

2026-04-15T12:23:15.5733333+00:00

Hi @Steven Culshaw

We have reached out to you in Private messages for additional details, could you please look into it and share us the details? Thanks
Souad Bdeir 10 Reputation points

2026-04-15T14:27:56.8066667+00:00
I’m experiencing the same issue.

I’m using an Azure Static Web App on the Free plan with the built-in Entra ID authentication (no custom app registration).

My configuration enforces authentication on all routes and redirects unauthenticated users to AAD login.

What I’m seeing:

GitHub authentication works correctly

Built-in AAD authentication redirects to https://identity.7.azurestaticapps.net/.auth/login/aad/callback, which then returns 401

After the failed AAD login attempt, /.auth/me returns {"clientPrincipal": null}

For comparison, I deployed several other Free plan Static Web Apps about a week ago, and those were redirected to identity.4.azurestaticapps.net instead of identity.7.azurestaticapps.net, and AAD auth works correctly there.

Here is my staticwebapp.config.json:

{ "routes": [ { "route": "/*", "allowedRoles": ["authenticated"] } ], "responseOverrides": { "401": { "statusCode": 302, "redirect": "/.auth/login/aad" } } }

Any help or insight would be appreciated!
orsevliv8 5 Reputation points

2026-04-15T17:53:39.3333333+00:00
I can confirm that Static Web App built-in AAD provider is broken whether identity.7.azurestaticapps.net or identity.4.azurestaticapps.net , Free or Standard plan, it always ends up in 401 Unauthorized loop.

I have tested with built-in authenticated as well as custom test roles and it produces the same result. Invitation flow is broken.

Simple staticwebapp.config.json to reproduce the issue. AAD invitations with role thisisbroken will fail.

{ "routes": [ { "allowedRoles": ["thisisbroken"], "route": "/*" } ] }

I have an older app using identity.3.azurestaticapps.net which still works as expected.

Answer accepted by question author

0 additional answers

Your answer

Praneeth Maddali 9,115 Reputation points Microsoft External Staff Moderator

2026-04-15T09:58:11.22+00:00

Hi @Steven Culshaw

Thank you for contacting us about the some issues with the built in auth for static web apps issue. We have begun looking into it and will share our suggestions with you as soon as possible. If you have any additional details or concerns in the meantime, please let us know. We appreciate your patience while we work on this.
Steven Culshaw 50 Reputation points

2026-04-15T11:05:54.3833333+00:00

Thanks @Praneeth Maddali
Praneeth Maddali 9,115 Reputation points Microsoft External Staff Moderator

2026-04-15T12:23:15.5733333+00:00

Hi @Steven Culshaw

We have reached out to you in Private messages for additional details, could you please look into it and share us the details? Thanks
Souad Bdeir 10 Reputation points

2026-04-15T14:27:56.8066667+00:00

I’m experiencing the same issue.

I’m using an Azure Static Web App on the Free plan with the built-in Entra ID authentication (no custom app registration).

My configuration enforces authentication on all routes and redirects unauthenticated users to AAD login.

What I’m seeing:

GitHub authentication works correctly

Built-in AAD authentication redirects to https://identity.7.azurestaticapps.net/.auth/login/aad/callback, which then returns 401

After the failed AAD login attempt, /.auth/me returns {"clientPrincipal": null}

For comparison, I deployed several other Free plan Static Web Apps about a week ago, and those were redirected to identity.4.azurestaticapps.net instead of identity.7.azurestaticapps.net, and AAD auth works correctly there.

Here is my staticwebapp.config.json:

{ "routes": [ { "route": "/*", "allowedRoles": ["authenticated"] } ], "responseOverrides": { "401": { "statusCode": 302, "redirect": "/.auth/login/aad" } } }

Any help or insight would be appreciated!
orsevliv8 5 Reputation points

2026-04-15T17:53:39.3333333+00:00

I can confirm that Static Web App built-in AAD provider is broken whether identity.7.azurestaticapps.net or identity.4.azurestaticapps.net , Free or Standard plan, it always ends up in 401 Unauthorized loop.

I have tested with built-in authenticated as well as custom test roles and it produces the same result. Invitation flow is broken.

Simple staticwebapp.config.json to reproduce the issue. AAD invitations with role thisisbroken will fail.

{ "routes": [ { "allowedRoles": ["thisisbroken"], "route": "/*" } ] }

I have an older app using identity.3.azurestaticapps.net which still works as expected.

Answer 1

Hi @Steven Culshaw

Thanks for confirming from PVT chat

I’m glad to hear the issue is now resolved. Your latest deployment worked successfully because it was routed to a healthy identity backend (identity.2). The earlier authentication failures were caused by a know issue limited to the identity.7 backend, which the team is working

If this answer was helpful, please do click “Accept the answer”, as this may benefit other community members as well.

If you have any additional questions, feel free to let me know in the comments—I’d be happy to help.

Share via

We are having some issues with the built in auth for static web apps - it only affects apps deployed in the last 48 hours

0 additional answers

Your answer