How to fix "AADSTS50011: Reply address did not match because of case sensitivity."

So, you got an AADSTS50011 error code? It's just Azure AD's authentication acting up because of an invalid reply address! Here are a bunch of different reasons that could have led to this error. This post describes the variant where the URL's case sensitivity differs from what's configured. For me, the most typical scenario where I run into this error is accessing the app from SharePoint.

Problem

In short: When trying to run a code that tries to authenticate against AAD (like a SharePoint Online web part or a Teams tab), you're getting an error somewhat like this:

AADSTS50011: The reply address [...] does not match the reply addresses configured for the application: '[guid]'. More details: Reply address did not match because of case sensitivity.

This is another variation of the good old "AADSTS50011: The reply address does not match the reply addresses configured"-error.

I recently encountered this version of the error. Normally, you don't get any extra details - the "More details:" -section will just say "not available" or some such explanation. But I guess a lot of people have been struggling with the case sensitivity of the URLs (I wonder who thought that was a good idea?), and Microsoft has opted to provide this, slightly improved version of the classical reply-URL error.

For once, the error message actually tells you exactly what's wrong!

At least, it's likely that it does.

See, I ran into this issue with SharePoint Online, as I was supposed to have an SPFx web part running on a certain page, authenticating and doing a few things. For this, I had simply registered said page as the redirect URI.

Your situation might be similar - my URL had "[site]/Pages/default.aspx" in it, but I entered it as "[site]/pages/default.aspx" in the configuration.

This shouldn't usually matter. SharePoint normally handles redirection between differently capitalized versions of the URL, and you should only need to use one version of the URL. Just copying whatever URL that's in the address bar when you enter the page generally works - simple as that.

However, that doesn't really always work as it should, and you don't always have just one version of the URL. That means, that you'll just have to make sure your links always point to whatever address SharePoint actually resolves as the default - so make sure to either use only the web's address (e.g. use the URL without library and page names), or use the address SharePoint returns to you by default. Or you can use both - you just can't use multiple different capitalizations, for some reason!

Solution

The solution is 50% obvious, but 50% gotcha.

If you think it's easily done - and you can just change the case in the reply address from "/Pages/default.aspx" to "/pages/default.aspx" and be done with it, you're only half correct. Whereas checking for reply addresses in the authentication is case-sensitive, saving the URLs is not.

If you just fix the URL and save it, it will look like it saved but it didn't actually change the reply address. It still won't work.

So, this is what you'll need to do instead:

Time needed: 5 minutes.

How to fix the casing on Azure Active Directory app registration Redirect URI configuration?

1. Remove the offending value in the reply-url configuration

2. Save the changes (click the button at the bottom of the page)

3. Scroll back to the reply-urls, and add a new one, this time with the correct casing

4. Save again - and after this, it should work!

Seems incredibly redundant and somewhat obvious - but that's the gotcha for you!