Grant Admin Consent

Question

Grant Admin Consent

Erik Ransford 0

Get the following when trying to grant admin consent for an app.

Request Id: b0fd2c2b-b77e-4165-8836-2fcee97b3500

Correlation Id: fef81d86-e822-4810-b276-615ea5307f5b

Timestamp: 2026-07-20T18:46:47Z

Message: AADSTS50011: The redirect URI 'https://aad.portal.azure.com/TokenAuthorize/ExtensionName/Microsoft_AAD_RegisteredApps' specified in the request does not match the redirect URIs configured for the application 'e535e657-0666-4ad5-940a-c3cf6296a541'. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal. Navigate to https://aka.ms/redirectUriMismatchError to learn more about how to fix this.

0 comments

1 answer

Your answer

Answer 1

AADSTS50011 means the redirect_uri in the admin consent request does not exactly match a redirect URI configured on the app registration.

For the Microsoft identity platform admin consent endpoint, redirect_uri is required and it must exactly match one of the redirect URIs registered for the app.

Use this checklist:

In Microsoft Entra admin center, open App registrations and select app e535e657-0666-4ad5-940a-c3cf6296a541.
Check the app’s configured Redirect URIs.
Compare them to the URI in the error: https://aad.portal.azure.com/TokenAuthorize/ExtensionName/Microsoft_AAD_RegisteredApps
If granting consent from a copied or manually built URL, verify these values in the request:
- tenant is the correct tenant ID or domain
- client_id matches the intended app
- redirect_uri exactly matches a registered redirect URI
- scope is the expected scope
If the consent URL was provided by an app owner, verify the client_id before using it. Do not grant consent from a copied URL unless that value is confirmed.

If the portal flow is generating this redirect URI and it is not registered on the app, use an alternative consent path:

Go to Microsoft Entra admin center → App registrations → select the app → API permissions.
Select Grant admin consent.
If the portal consent page still fails, manually build the consent URL using the Microsoft identity platform admin consent endpoint and a redirect_uri that is already registered for the app.

Admin consent endpoint format:

https://login.microsoftonline.com/{tenant}/v2.0/adminconsent
    ?client_id={application-client-id}
    &scope=https://graph.microsoft.com/.default
    &redirect_uri={registered-redirect-uri}
    &state={optional-state}

Important validation points:

Do not use common for admin consent.
redirect_uri must exactly match a registered value.
For SharePoint Embedded guidance, the expected Graph scope in the admin consent URL is .default; if a different scope is used, confirm why.

If this is a multitenant app and consent has not yet been granted in the tenant, the service principal may not exist locally until an admin completes consent.