Urgent: Azure Account Access Blocked - Error 400 (redirect_uri_mismatch)

The error 400: redirect_uri_mismatch indicates that the redirect URI used in the sign-in request does not match the redirect URI configured on the identity provider side. In this scenario, the Google OAuth app configuration must be updated to match the Azure/Microsoft Entra configuration.

To resolve the issue, the application owner or tenant administrator needs to:

1. Identify the exact redirect URI Azure/Microsoft Entra is sending:
   • Trigger the sign-in again and capture the redirect URI shown in the error details, or
   • From the Azure portal, open the relevant app registration and copy the redirect URI configured there.
2. Verify and update the redirect URI in the identity provider (Google) configuration:
   • In the Google Cloud/Google Identity Provider configuration for this app, locate the list of authorized redirect URIs.
   • Add the exact redirect URI that Azure/Microsoft Entra is using (must match character-for-character, including scheme, path, and any trailing slashes).
3. Save changes and retry sign-in:
   • After updating the Google OAuth configuration, save the changes.
   • Wait a few minutes for propagation, then attempt sign-in again.

If the redirect URI being sent from the application is not the one that should be used, the app’s own configuration or code must be updated so that it sends the correct redirect URI that matches what is configured on both Azure/Microsoft Entra and Google.

If access to Azure is currently blocked for the affected user and there is no other admin account available, another tenant administrator must perform these configuration changes, or support must be engaged from an account that still has access.

References:

• Error AADSTS50011 with OpenID authentication: The redirect URI specified in the request does not match