## TL;DR

Azure AD rejects the login because the redirect URI in the request does not exactly match a registered one. Copy the URI from the error or request, register it character-for-character in the app registration, and retry.

## Error

```text
AADSTS50011: The redirect URI specified in the request does not match the redirect URIs configured for the application
```

## Steps

1. Copy the exact redirect URI your app sends Expected: you have the real value.
2. Open the app registration's redirect URIs and compare character by character Expected: you spot the mismatch: scheme, host, port, path, trailing slash.
3. Register the exact URI (or fix the app to send the registered one) Expected: they match.
4. Retry the login Expected: the error is gone.

## When to use

- AADSTS50011 on login
- The redirect URI is not registered exactly

## When not to use

- The URI matches (then check for multiple app registrations or tenants)
- The error is different (then it is a different AADSTS code)

## Tool compatibility

- Azure AD app registrations
- OAuth login flows

## Variant phrasings

### aadsts50011

The redirect URI must match the registered one exactly. Trailing slashes count.

### redirect uri does not match azure

Same: compare character for character, including scheme and port.

## Why it happens

Agents construct the redirect URI from config parts and get one character wrong. Azure compares exactly, with no fuzzy matching.

## Edge cases

- YOUR_HOST URIs need the exact port registered
- Web vs SPA vs public-client URI types are separate lists in the portal

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_12aHqau8GiFDscw4f4X4Pw