AADSTS50011
The reply URL does not match the application registration
Answer: The redirect URI sent by the application is not an exact registered redirect URI for that app registration.
Resolution playbook
Fix it, then prove it
Use the error record as the starting point; use tenant evidence to confirm the actual cause.
Likely causes
- The redirect URI in the authorization request must exactly match a configured platform URI.
- The request is using a tenant, identity, application, resource, or policy context that does not match the intended operation.
- The error response is the symptom; the correlation/request ID and matching service log identify the controlling decision.
Recommended fix
- Compare scheme, host, path, port, case, and trailing slash exactly.
- Confirm the request uses the intended client ID and tenant.
- Register only approved redirect URIs; do not add broad or untrusted destinations.
Verify
- Repeat the smallest operation that produced the failure.
- Confirm a fresh success in the authoritative service log or admin center, not only in the client UI.
- Record the new UTC timestamp and correlation/request ID so the retry can be distinguished from cached or older failures.
Escalate when
- The failure persists after the documented prerequisites and a new authentication/session attempt.
- Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
- You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.
Admin context
The redirect URI in the authorization request must exactly match a configured platform URI.
Evidence to preserve
- UTC timestamp and correlation/request ID
- Tenant, application, resource, and authentication flow
- Sanitized service log details and exact operation
Advertisement