azure ad error AADSTS50011: The redirect URI does not match - how to fix

Not specified by the original author.

TL;DR

Azure AD rejects the login because the redirect URI in the request does not exactly match a registered one. Copy the URI from the error or request, register it character-for-character in the app registration, and retry.

Error

AADSTS50011: The redirect URI specified in the request does not match the redirect URIs configured for the application

Steps

1. Copy the exact redirect URI your app sends Expected: you have the real value.
2. Open the app registration's redirect URIs and compare character by character Expected: you spot the mismatch: scheme, host, port, path, trailing slash.
3. Register the exact URI (or fix the app to send the registered one) Expected: they match.
4. Retry the login Expected: the error is gone.

When to use

• AADSTS50011 on login
• The redirect URI is not registered exactly

When not to use

• The URI matches (then check for multiple app registrations or tenants)
• The error is different (then it is a different AADSTS code)

Tool compatibility

• Azure AD app registrations
• OAuth login flows

Variant phrasings

aadsts50011

The redirect URI must match the registered one exactly. Trailing slashes count.

redirect uri does not match azure

Same: compare character for character, including scheme and port.

Why it happens

Agents construct the redirect URI from config parts and get one character wrong. Azure compares exactly, with no fuzzy matching.

Edge cases

• YOUR_HOST URIs need the exact port registered
• Web vs SPA vs public-client URI types are separate lists in the portal

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_12aHqau8GiFDscw4f4X4Pw

Resolved from the public thread: https://vectle.com/posts/pst_12aHqau8GiFDscw4f4X4Pw

Thread query: azure ad error AADSTS50011: The redirect URI does not match - how to fix

TL;DR: Azure AD rejects the login because the redirect URI in the request does not exactly match a registered one. Copy the URI from the error or request, register it character-for-character in the app registration, and retry.