Runtime App Reply URLs

Runtime app reply URLs

The solution includes an ASP.NET administration website (the Web app service) that signs users in with Entra ID (Azure AD) using OpenID Connect. For sign-in to work, Entra ID has to know — and trust — the URL it is allowed to send the authentication response back to. That trusted URL is the reply URL, shown in the Azure portal as a Redirect URI.

This step is part of App registrations setup. Configure it on the runtime app registration only — the installer app registration doesn't need reply URLs.

You need the web app's URL first. The reply URL is the root address of the Azure App Service that hosts the admin website. If you haven't created that App Service yet you can come back to this step later — but don't skip it, or nobody will be able to sign in to the website.

What the reply URL must be

Register one Web redirect URI: the root URL of your App Service, over HTTPS, with a trailing slash:

https://<your-app-service-name>.azurewebsites.net/

A few things that commonly trip people up:

• The trailing slash matters. The app sends https://<host>/ (with the slash) as its redirect_uri, and Entra ID matches redirect URIs exactly. If you register the URL without the trailing slash you'll get AADSTS50011: The redirect URI ... does not match at sign-in.
• HTTPS only. App Service serves HTTPS by default — don't register an http:// URL.
• Use your custom domain if you have one. If users reach the site on a custom domain (for example https://analytics.contoso.com/), register that URL instead of — or in addition to — the *.azurewebsites.net one. It must match whatever you set as the WebAppURL app setting on the web app (see the Configuration reference).
• This one URL also covers sign-out. The app uses the same root URL as its post-logout redirect, so you don't need a separate entry for signing out.

Where to find the URL. If you're using the installer, it's shown in the configuration wizard:

If you deployed manually, copy the Default domain / URL from the App Service Overview blade in the Azure portal. It's also the value of the WebAppURL app setting.

Add the reply URL

1. In the Azure portal, open the runtime app registration and go to Authentication.

2. Click Add a platform and choose Web.

   Choose Web, not Single-page application — the admin site is a server-side (confidential-client) app.

   

3. Under Redirect URIs, enter your App Service root URL — HTTPS, with the trailing slash — as described above. Leave Front-channel logout URL blank.

   

4. Under Implicit grant and hybrid flows, tick ID tokens (used for implicit and hybrid flows).

   The website signs in with the hybrid code id_token flow, so it receives the ID token directly from the sign-in redirect — that's why ID tokens must be enabled. Ticking Access tokens as well is harmless but not required: the app redeems the authorization code for access tokens server-side.

   

5. Click Configure (or Save) to store the changes.

If a Web platform already exists on the app registration, you don't need to add another one — just add the redirect URI to the existing platform and make sure ID tokens is ticked.

Multiple environments

If you run more than one deployment against the same app registration (for example a test site and a production site), add each site's root URL as its own redirect URI under the same Web platform. Every entry must be the exact HTTPS root URL with a trailing slash.

Verify

Browse to the root URL of your App Service. You should be redirected to the Microsoft sign-in page and, after signing in, land back on the admin website.

If sign-in fails with AADSTS50011 (redirect URI mismatch), the registered reply URL doesn't exactly match what the app sent. Re-check for:

• a missing (or extra) trailing slash,
• http vs https,
• a custom domain the app uses but that isn't registered,
• a typo in the host name.

The reply URL you register here must match the web app's WebAppURL app setting exactly. You can validate the runtime configuration end to end from the installer — see Testing Runtime application.