NAA does not work in Outlook when a custom 365 OWA (Vanity) URL is used

[GrumpyAL]

NAA does not work in Outlook when a custom 365 OWA (Vanity) URL is used

Your Environment

• Platform [PC desktop, Mac, iOS, Office on the web]: PC, OWA
• Host [Excel, Word, PowerPoint, etc.]: Outlook
• Office version number: n/a
• Operating System: Windows
• Browser (if using Office on the web): Chrome

Expected behavior

When using NAA in Outlook we are able to get a token.

Current behavior

So... I realize that this scenario is probably rare as not a lot of 365 tenants seem to have custom/vanity URLs anymore. But...let's say my domain is www.contoso.com and I have 365 setup such that I get to Outlook on the Web via o365.mail.contoso.com.

When I try to use an Outlook Add-in with NAA, the token get fails with a pop that says "The redirect URI https://o365.mail.contoso.com/mail/oauthRedirect.html specified in the request does not match the redirect URIs configured for the application: '9199bf20-a13f-4107-85dc-02114787ef48`. Make sure the redirect URI....

The given appID appears to be for OWA and is NOT the app registration being used by NAA. This redirect happens normally when I use a standard OWA URL and works fine. The error in the console that appears is about monitor_window_timeout. We checked the indicated support doc (https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/errors.md#monitor_window_timeout) but the information here didn't appear to be relevant. We tried setting the redirectUri anyway but this doesn't appear to do anything (I'm guessing because the request is being brokered through Outlook).

Steps to reproduce

1. Have custom OWA URL (e.g. mail.yourDomain.com instead of outlook.office.com/mail
2. Attempt to get NAA token using normal methods/samples
3. The error should pop-up in the window that attempts to get the NAA token via pop-up and console errors should appear

Link to live example(s)

n/a

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• Redirect URL mismatch error when using SSO with Office.js in Outlook add-in, if Outlook URL is custom/vanity URL. #2710

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

For vanity domains, the tenant will need to add an additional reply URL. The tenant administrator can resolve it manually. More on it can be found here: https://stackoverflow.com/questions/38372040/change-azure-active-directory-reply-url-via-powershell-command

Reference:

• Redirect URL mismatch error when using SSO with Office.js in Outlook add-in, if Outlook URL is custom/vanity URL. #2710 (comment)

Solution 2:

We have a limitation on Outlook Web extensibility for this API whereby it does not work with Vanity Domains. According to our design, it should work with O365/M365 domains. We presently do not have a solution for this limitation. We are working on an improved authentication model for Add-ins, which should resolve this issue for users. getAccessTokenAsync will not work, but we recommend implementing a fallback with a login screen/display dialog. Use SSO to get the identity of the signed-in user - Office Add-ins | Microsoft Learn

Reference:

• Redirect URL mismatch error when using SSO with Office.js in Outlook add-in, if Outlook URL is custom/vanity URL. #2710 (comment)

Powered by issue-sentinel

[davidchesnut]

Hi GrumpyAL,

How are you making the request? Are you using createNestablePublicClientApplication? As long as you list "https://o365.mail.contoso.com/mail/oauthRedirect.html" as a redirect URI in your app registration, it should work. Keep in mind it is case sensitive. More info at Redirect URI (reply URL) outline and restrictions.

Cheers,
David

[GrumpyAL]

Hey David Chesnut (@davidchesnut),

We are using createNestablePublicClientApplication, yes. The customer has added the redirect URI from the error in the app registration. For this case, should it go under SPA or under web (I assume SPA)? We'll double-check that the case matches.

And just to reiterate, the error that we see claiming that the redirect URI does not match gives an application ID that is not for the NAA app registration, but (from what I can tell) Is an app ID for Outlook Web.

Thanks