External Tenant - Redirect URI mismatch when logging in with Microsoft Account in Azure External ID / B2C tenant

Question

External Tenant - Redirect URI mismatch when logging in with Microsoft Account in Azure External ID / B2C tenant

Tan Yik Zhang 25

I'm currently facing an issue with Microsoft Account (MSA) sign-in when using Azure External ID (External Identity / B2C).

When trying to sign in with a Microsoft Account under External Tenant / B2C, the authentication flow fails with the following error:

invalid_request: The provided value for the input parameter 'redirect_uri' is not valid. The expected value is a URI which matches a redirect URI registered for this client application.

Details User's image

Tenant Type: Azure External Tenant (B2C)

Identity Provider: Microsoft Account (MSA)

Login scenario: Web app using OpenID Connect / OAuth2

Error Behavior:
- For B2B users → works fine (redirects to login.live.com with redirect_uri=https://login.microsoftonline.com)
- For B2C / External ID users → fails with redirect URI mismatch (redirects to login.live.com with redirect_uri=https://agtivexternal.ciamlogin.com)

The key difference I’ve observed:

In External Tenant / B2C, the redirect URI used is https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%agtivexternal.ciamlogin.com
In B2B, the redirect URI is
https://login.live.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com

The ciamlogin.com domain seems to cause the redirect URI validation to fail.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Anonymous

Hi Zhang,

Thank you for posting your query on Microsoft Q&A.

This error means the redirect URI used during sign-in is not listed in your Azure app registration. Azure only accepts redirect URIs that are added exactly as they appear in the authentication request.

For example, if the sign-in flow sends users to:

https://agtivexternal.ciamlogin.com

but this URL is not added in your app registration, Azure will block the login with a redirect URI mismatch.

Steps to fix the issue:

Copy the redirect URI from the error message The message will show the redirect URI Azure is expecting. Copy it exactly as shown.
Add it to your app registration
- Open the Azure Portal
  - Go to Microsoft Entra ID → App registrations
    - Select your application
      - Open Authentication
        
        Under Redirect URIs, add the exact URI from step 1
        
        Save your changes
        
        Make sure it matches perfectly The redirect URI must be identical, including https://, uppercase/lowercase letters, and any trailing slash.
        
        Clear your browser cache or use a private window Sometimes cached info causes the same error to appear even after fixing the URL.
        
        Try signing in again Once the correct redirect URI is added, the Microsoft Account login should work without issues.

Note:

If you have multiple environments (dev/test/prod), make sure each redirect URI is added.
Azure does not allow wildcard redirect URIs each one must be added individually.
The ciamlogin.com domain you’re seeing is normal in External ID/B2C flows, as long as it's part of your setup.

Microsoft documentation

I hope this information is helpful. Please feel free to reach out if you have any further questions. If the answer is helpful, please click "Accept Answer" and kindly upvote it.

Tan Yik Zhang 25 Reputation points

2025-11-14T09:53:58.53+00:00
Hi Chivarla.

Thank you for your help.

I tried your advice to add the redirect URI for https://agtivexternal.ciamlogin.com in my application, but it seems unable to work.

Please let me add some extra information.

My application will log in to the website using B2C / Azure Entra External ID via

All these account is invited via Invite external user (Preview) in Azure

We tested 3 scenarios with different types of guest user identities in our Microsoft Entra External ID (CIAM) tenant:

ExternalAzureAD (******@agtiv.com)

Mail (******@gmail.com)

MicrosoftAccount (******@outlook.com)

Only MicrosoftAccount (personal Outlook/Hotmail/Live accounts or Google accounts that are linked with Microsoft) fails during login.

ExternalAzureAD users and mail (Passcode) users will continue the login process by receiving a code or key in a password to sign in.

Only for the Microsoft Account identity, it will hit the redirect_uri error on login.live.com

What I suspect is that when the B2C detects the account identity with MicrosoftAccount, it will route to Microsoft Default login with URL login.live.com. However, login.live.com didn't accept any of XXX.ciamlogin.com, which caused the error.

Anyway, we decided to create a new Microsoft Entra ID to handle this case, it seems like Azure Entra External ID didn't support with the Microsoft Account Login.

Thank you.
Anonymous

2025-11-17T09:18:41.3333333+00:00
Hi Zhang,

Thank you for sharing additional information.

As per our understanding, you are encountering a redirect URI mismatch when using Microsoft Account (personal Outlook, Hotmail, or Live) identities with Azure Entra External ID (CIAM/B2C). You have correctly tried registering https://agtivexternal.ciamlogin.com as a redirect URI, but Microsoft Account sign-ins still fail with a redirect URI error, even though other guest user types (like Azure AD or passcode users) can sign in without this problem.

When you use Microsoft Account sign-in (MSA) in Entra External ID (formerly Azure AD B2C, CIAM), the authentication flow redirects users to login.live.com.

login.live.com only accepts specific registered redirect URIs tied to Microsoft’s own multi-tenant applications and will not accept arbitrary custom domains like xxx.ciamlogin.com for login callbacks outside of Microsoft-controlled apps.

As a result, the Microsoft Account login flow is unable to complete due to this validation on the Microsoft Account (MSA) identity provider, even if you’ve registered the custom URI in your Azure tenant’s app registration.

This is a known product limitation for Entra External ID/CIAM tenants: currently, Microsoft Accounts (personal MSA/Outlook/Live accounts) are not fully supported as identity providers in all CIAM External ID/B2C scenarios using custom domains or user flows. Only organizational accounts (Azure AD), Google, and passcode email sign-in are fully supported for guest or external user scenarios with custom redirect URIs.

Alternative Solution:

If you need to support Microsoft Account (MSA) sign-in for external users, the current workaround is to use a separate Microsoft Entra ID (workforce tenant) that supports MSA, or switch to Azure AD B2C classic (not Entra External ID) where custom policies might provide more flexibility.

For most CIAM/External ID tenants, it’s best to focus on supported providers like Azure AD, Google, and email authentication until broader support is officially added for MSA with custom redirect URIs.

Check Known Limitations:

Microsoft’s public documentation and Q&A threads confirm that supporting personal MSA sign-ins in External ID tenants with custom domains is not generally available as of late 2025, and this is expected product behavior, not a misconfiguration on your part.

No public preview feature currently lifts this restriction in Entra External ID, and login.live.com’s redirect URI checks are outside tenant administrator control.

Helpful Resources

Redirect URI best practices

Microsoft Entra External ID - Supported scenarios

I hope this information is helpful. Please feel free to reach out if you have any further questions. If the answer is helpful, please click "Accept Answer" and kindly Upvote it.
Bas Kooistra 0 Reputation points

2026-06-30T08:41:21.8433333+00:00

A bit late to the show, but I was encountering the same issues.
I have a administrator account (connected to my normal azure account) with which I can administer the tenant itself and I have an actual B2C user account, with the same email address.
I have added my coworker with B2B invite to the same tenant as an administrator, using his gmail address. When he tries to create a B2C user account with the same email address, he gets the same error.