A kelp-ash glaze studio’s sign-in fails with a redirect URI mismatch after a teammate changed the web app’s public URL. What should the developer update?

Microsoft Entra redirect URIs must match the live reply URL exactly, including scheme, host, path, and the registered platform type (web versus single-page application). After the kelp-ash glaze studio’s public URL changed, sign-in fails with a redirect URI mismatch until the app registration’s redirect URI (and platform) are updated to the new address Entra will redirect to after authentication.

Updating only the App Service custom domain TLS binding fails to fix Entra’s allowlist. TLS and custom domains make HTTPS work for the site, but Entra still compares the redirect_uri query parameter to registered values. An unchanged app registration continues to reject the new URL.

Changing the Cosmos DB connection string used for session cookies fails because redirect mismatch happens during the authorization redirect, before your app’s session store is the deciding factor. Cosmos connectivity does not register reply URLs with Entra.

Opening the storage account firewall for the new hostname fails because blob firewall rules do not participate in the OpenID Connect redirect handshake. Storage networking is unrelated to Entra’s redirect URI validation.

Exam caveat: trailing slashes, http versus https, and www versus apex hosts all count. A “almost right” URI still fails. SPA platform entries also expect different redirect and logout patterns than traditional web confidential clients.

Operational check: reproduce the authorize request and copy the redirect_uri value from the browser. Compare it character-for-character to Authentication blade entries on the app registration, add the new URI under the correct platform, remove stale URIs you no longer use, and retry sign-in until Entra completes the redirect without AADSTS redirect errors.