How do I debug Azure AD SSO callback issues?

Here’s a practical way to debug Azure AD / Microsoft Entra ID SSO callback issues.

1) Confirm the exact failure point

Figure out whether the problem is:

• Before redirecting to Azure AD
• During login at Azure AD
• On the callback back to your app
• After the callback, when your app validates the token/session

Common callback symptoms:

• redirect_uri mismatch
• AADSTS50011 (reply URL mismatch)
• invalid_state
• invalid_nonce
• correlation failed
• 401/403 after return
• app receives code but token exchange fails

---

2) Check Azure sign-in logs first

In Microsoft Entra admin center:

• Identity → Monitoring & health → Sign-in logs
• Find the failed sign-in event
• Open it and inspect:
  • Status / error code
  • Correlation ID
  • Timestamp
  • Application
  • Conditional Access results
  • Authentication details

If the error is at Azure side, the logs usually tell you exactly why.

Useful error patterns

• AADSTS50011: redirect URI does not match app registration
• AADSTS700016: app/client ID not found
• AADSTS7000215: invalid client secret
• AADSTS900561: invalid request format or malformed authorization request
• AADSTS50058: user not signed in / silent auth issue

---

3) Verify redirect URI / callback URL

This is the most common issue.

Check that the callback URL in your app matches exactly what’s registered in Azure:

• Scheme: http vs https
• Hostname
• Port
• Path
• Trailing slash
• Case sensitivity in path
• Environment-specific domains

Example:

• App sends: https://app.example.com/auth/callback
• Azure has: https://app.example.com/auth/callback/
• Result: mismatch

For local dev, ensure local callback URIs are added explicitly, e.g.:

• http://localhost:3000/auth/callback

---

4) Inspect the authorization request in the browser

Use browser dev tools or a proxy like Fiddler, Charles, or mitmproxy.

Look at the initial redirect to Azure AD:

• client_id
• redirect_uri
• response_type
• scope
• state
• nonce
• code_challenge / code_challenge_method if using PKCE

Things to verify:

• redirect_uri is URL-encoded correctly
• state is present and preserved
• nonce is present for OIDC flows
• PKCE values are consistent if using SPA/public client

---

5) Check the callback request your app receives

When Azure redirects back, inspect:

• Query parameters:
  • code
  • state
  • error
  • error_description
• Whether the callback endpoint is reached at all
• Whether your app rejects it before token exchange

If you see:

• error=access_denied: user canceled or policy blocked
• error=invalid_request: bad auth request
• error=interaction_required: extra login step needed
• error=login_required: no session / SSO not possible silently

---

6) Validate state and nonce handling

Many callback failures happen because the app doesn’t persist these correctly.

Check:

• Is state stored server-side or in a secure cookie/session?
• Is the same session available on callback?
• Are cookies blocked or misconfigured?
• Is SameSite causing issues?

Cookie issues are common

For web apps, ensure auth cookies are compatible with the redirect flow:

• If cross-site redirects are involved, SameSite=None; Secure may be required
• Ensure HTTPS in production

If the state doesn’t match, your app may throw:

• invalid_state
• CSRF validation failure

---

7) Make sure the callback endpoint is reachable

Confirm:

• Reverse proxy / load balancer forwards the path correctly
• No 404/500 on the callback route
• No redirect loops
• App is listening on the expected host/port
• TLS termination is correct

If behind a proxy, ensure headers like:

• X-Forwarded-Proto
• X-Forwarded-Host are handled properly, otherwise your app may generate wrong callback URLs.

---

8) Debug token exchange

If your app receives the authorization code but fails afterward, check the code-to-token exchange.

Common problems:

• Wrong client secret
• Secret expired
• Wrong tenant authority
• Redirect URI mismatch during token exchange
• Using code twice
• Code expired
• PKCE verifier mismatch

Typical errors:

• invalid_client
• invalid_grant
• bad_verification_code

Check:

• client_id
• client_secret or certificate
• authority / tenant
• redirect_uri matches exactly
• Authorization code is exchanged once and quickly

---

9) Confirm the app registration settings in Azure

In the App Registration:

• Authentication
  • correct platform type: Web / SPA / Mobile
  • correct redirect URIs
• Certificates & secrets
  • secret valid and unexpired
• API permissions
  • permissions granted/admin consented if required
• Token configuration
  • claims configured if your app expects them

Also verify:

• You’re using the correct tenant:
  • common
  • organizations
  • specific tenant ID
• Multi-tenant app is configured if users come from other tenants

---

10) Turn on framework/library logging

Enable verbose logs in your auth library.

Examples:

• MSAL: enable debug logging
• OpenID Connect middleware: log auth events
• Passport / NextAuth / Spring Security / ASP.NET / Node libraries: turn on auth debug mode

Useful to log:

• auth request parameters
• callback query string
• token endpoint response
• exception details
• correlation IDs

Be careful not to log:

• access tokens
• ID tokens
• secrets
• full authorization codes in production logs

---

11) Use correlation IDs to tie things together

Azure sign-in logs often contain a Correlation ID.

Match that with:

• your application logs
• reverse proxy logs
• browser request timestamps

This helps determine whether the failure is:

• at Azure
• during redirect
• in your callback handler
• during token redemption

---

12) Check Conditional Access and MFA

Sometimes the callback looks broken but Azure is simply enforcing policy.

In sign-in logs, check:

• Conditional Access failures
• MFA required
• device compliance
• location-based restrictions
• token protection / authentication strength

If policy blocks the sign-in, your app may only see a generic failure.

---

13) Common callback bugs to watch for

• Callback URL registered for wrong environment
• App generating http callback while Azure expects https
• Missing state session after load balancer hop
• Cookie not returned because of SameSite settings
• Proxy stripping query string
• Multiple app instances not sharing session store
• Old secret expired
• Using SPA flow for a server-side app, or vice versa

---

14) Minimal troubleshooting checklist

If you want the fastest path:

1. Check Azure Sign-in logs
2. Verify exact redirect URI
3. Inspect browser redirect parameters
4. Confirm callback route is hit and query params are present
5. Validate state/cookie/session handling
6. Check token exchange errors
7. Verify client secret/certificate
8. Review Conditional Access

---

15) If you share details, I can help narrow it down

If you paste any of these, I can help diagnose the issue:

• The exact error message
• The Azure sign-in log error code
• Your callback URL
• Whether this is SPA, web app, or mobile/native
• Framework/library used
• The auth flow:
  • OIDC auth code flow
  • PKCE
  • SAML
  • WS-Fed

If you want, I can also give you a step-by-step Azure AD callback debugging checklist for a specific stack like ASP.NET Core, Node.js, React, Spring Boot, or Python.