KBY Technologies Logo
AADSTS50011

AADSTS50011: redirect URI doesn't match the app registration

Sign-in fails because the redirect URI the app sent doesn't match any redirect URI registered for the app in Microsoft Entra ID.

From Microsoft's documentation, checked 9 Nov 2026.

Microsoft Entra ID sign-in (OpenID Connect and OAuth 2.0)App registrationhigh
Error text as Microsoft documents it
AADSTS50011: The redirect URI <Redirect URI> specified in the request does not match the redirect URIs configured for the application <AppGUID>. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal.

Also searched as: InvalidReplyTo · reply URL mismatch · redirect URI mismatch

What it means

After the user authenticates, Entra ID compares the redirect URI in the request with the redirect URIs on the app registration. If none match, it returns AADSTS50011 instead of sending the user back to the app. Either register the URI the app sends, or change the app so it sends a URI that's already registered.

Common causes

  • The redirect URI (reply URL) in the app's code or configuration isn't registered on the app registration.
  • The app sends a redirect URI other than the one you intended; Microsoft says to fix the app's code or configuration in that case.
From Microsoft's documentation

How to fix it

1

Find the failing sign-in

In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out.

$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 50011 and createdDateTime ge $since" -Top 10
2

Open the app registration

Copy the application ID and redirect URI from the error. In the Azure portal open Microsoft Entra ID > App registrations, find the app by its application ID and select Authentication.

3

Add the redirect URI, or fix the app

Under Platform configurations select Add URI, add the redirect URI from the error message and save. If that URI isn't the one the app should use, update the app's code or configuration instead.

How to confirm it's fixed

  • Wait three to five minutes after saving, then send the sign-in request again.
  • If the Entra sign-in page doesn't appear, clear the browser's saved credentials or use an InPrivate window.
Copyable operational controls

Related engineering templates

Conditional Access Deployment Checklist
The KBY Brief

Follow Microsoft Entra ID failures and fixes

A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.