OpenID Connect redirect URI mismatch in Entra External ID

Question

I'm configuring a custom web application with Microsoft Entra External ID. After sign-in, users are getting an AADSTS50011 redirect URI mismatch error. The redirect URI configured in the application seems correct. What could be causing this issue?

Answer 1

Hello William,

The error AADSTS50011 (redirect URI mismatch) indicates that the redirect URI sent by your application during the OpenID Connect request does not exactly match any URI configured in the Entra application.

Even if the value looks correct, Entra ID performs a strict comparison, so small differences will cause this issue. https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts50011-redirect-uri-mismatch

In Entra External ID scenarios, this is commonly caused by:

Case sensitivity differences (e.g., /signin-oidc vs /Signin-oidc)

Trailing slash mismatch (/callback vs /callback/)

HTTP vs HTTPS mismatch

Port differences or environment changes (dev vs prod)

Reverse proxy/load balancer rewriting the URL

The application sending a different redirect URI than expected

To resolve this:

Capture the actual redirect_uri sent in the request (browser dev tools or Fiddler).

Compare it character-by-character with the Redirect URI configured in: Entra ID → App registration → Authentication

Ensure both values match exactly. If not, either:

Update the app configuration, or

  Add the exact URI to the app registration
  

The key point is that Entra ID requires an exact match (including scheme, case, path, and trailing slash) and will not normalize the URL. [

If you still see the issue, please share the redirect URI from the error message so we can help validate it.

Answer 2

AADSTS50011 in this scenario is almost always caused by a mismatch between the redirect URI that the app actually sends in the OIDC request and the redirect URI(s) configured in Microsoft Entra ID for that app registration, even if the configured value looks correct.

Typical causes in Entra External ID/OIDC setups include:

1. Exact string mismatch
   • The redirect URI in the request must match one of the configured redirect URIs exactly, including:
     • Scheme (http vs https)
     • Hostname (including subdomains)
     • Path and trailing slash
     • Port (for localhost/dev)
   • If any character differs, Entra ID returns AADSTS50011.
2. Wrong redirect URI registered for the app
   • The app may be sending a different redirect URI than expected (for example, framework default like /signin-oidc or a different path used by the External ID user flow), while only another URI is registered.
   • In this case, either:
     • Add the redirect URI shown in the error message to the app registration, or
     • Update the app’s configuration/code so the redirect_uri parameter matches a registered value.
3. Multiple environments (dev/test/prod) or host changes
   • The app might be running at a different URL (e.g., new domain, different port, or localhost) than the one registered.
   • Each environment’s redirect URI must be explicitly added to the app registration or separated into different app registrations.
4. Incorrect platform type or client classification
   • Entra ID uses the redirect URI type to classify the client (web vs public client). If the redirect URI type in the app registration does not match how the app is behaving (for example, using a web redirect URI for a native client pattern), the redirect URI may not be accepted.

To resolve:

1. Trigger a sign-in and capture the actual redirect_uri being sent (from the error message or via browser dev tools/Fiddler).
2. In Azure portal → Microsoft Entra ID → App registrations → [your app] → Authentication:
   • Add that exact URI as a redirect URI for the correct platform, or
   • If the URI is not what is desired, fix the app’s configuration so it sends the correct value.
3. Save changes and wait a few minutes for propagation, then retry sign-in.

If using SAML-based SSO anywhere in the flow, the same principle applies to the AssertionConsumerServiceURL/Reply URL: it must match exactly what the app sends.

---

References:

• Error AADSTS50011 with OpenID authentication: The redirect URI specified in the request does not match
• Error AADSTS50011 with SAML authentication - The reply URL specified in the request does not match
• Redirect URI (reply URL) outline and restrictions
• Add a Microsoft Entra ID tenant as an OpenID Connect identity provider