Short answer
AADSTS50011 means the application sent a redirect_uri that Microsoft Entra ID cannot match to a URI registered for that app. Compare the URI in the failed authorization request with App registrations → your app → Authentication. Correct the application configuration if it sent the wrong callback; otherwise add the intended URI under the correct platform type. Do not add a URI you do not control.
This is a vendor-documentation guide. It has not been reproduced in a customer environment by this site.
Problem / symptoms
Users reach Microsoft Entra sign-in and then get rejected before returning to the application. The error commonly includes the requested URI and an application ID.
Exact error
AADSTS50011: The redirect URI specified in the request does not match the redirect URIs configured for the application.
The full message may include the URI and app ID. Treat tenant-specific values as sensitive when sharing logs.
Environment and scope
Microsoft Entra app registrations used by OIDC or OAuth 2.0 sign-in flows. A SAML app also has a reply-URL concept, but use the vendor’s SAML instructions if the failing request is SAML rather than an OIDC/OAuth authorization request.
What the evidence establishes
Entra compares the callback URI sent by the application with the redirect URIs registered for that app. A mismatch produces this code. A redirect URI is a security boundary: Entra only sends authorization responses to registered destinations.
Investigation
- Capture the failed sign-in’s timestamp, correlation ID, application ID, and requested redirect_uri from the error or sign-in details.
- Open the matching app registration by Application (client) ID. Check Authentication and the platform configuration used by this app (Web, Single-page application, or mobile/desktop).
- Compare the full URI, including scheme, host, port, path, and trailing slash where applicable. Check production and local-development callbacks separately.
- If the URI in the request is unexpected, inspect the app’s base URL, proxy headers, callback setting, and environment-specific configuration. Do not “fix” an incorrect callback by registering it blindly.
Root cause
The callback configured in the application and the callback allow-list in its Entra registration do not agree. Common sources of drift include a changed hostname, reverse-proxy scheme, port, path, or deployment environment. The exact difference must be read from the failing request; the error code alone does not say which side is wrong.
Resolution
Update the application to send its intended callback, or add that exact intended callback to the matching app registration under the right platform. Save the registration and allow several minutes for the change to take effect before retesting.
Avoid wildcard callbacks and do not expose development callbacks in a production registration without a reason. Microsoft recommends exact, controlled URIs because authorization responses can contain security tokens.
Verification
- Retry the same sign-in flow after the configuration has propagated.
- Confirm the request now contains the expected callback and Entra returns the response to the intended application endpoint.
- Check the new sign-in event; preserve the correlation ID if the failure remains.
- Confirm that a production login did not start using a development or untrusted callback.