AADSTS50011错误求助：Outlook与我方日历同步遇回复URL不匹配问题

Hey there, sorry to hear you're hitting this AADSTS50011 error after successfully syncing hundreds of accounts before. Let's break down the most likely fixes since this error always boils down to a mismatch between the redirect URI in your auth request and what's configured in your Azure AD app registration.

Here are the key steps to debug:

• Double-check your Azure AD app's redirect URI configuration
  Head to the Azure Portal, navigate to your app registration, go to the Authentication section, and verify every redirect URI listed matches exactly what's being sent in your auth request. Pay close attention to tiny details:

  • HTTP vs HTTPS (make sure they match—no accidental http in production!)
  • Trailing slashes (e.g., https://yourapp.com/callback vs https://yourapp.com/callback/ are treated as different)
  • Port numbers (if your local/test environment uses a specific port, it needs to be included in the config)
  • Case sensitivity (though rare, some environments might treat Callback vs callback as distinct)

• Capture the actual redirect URI from your request
  Use browser DevTools (Network tab) or a tool like Fiddler to inspect the auth request being sent to Azure AD. Look for the redirect_uri parameter in the request URL. Compare this directly to the URIs in your app registration—even a single character typo will trigger this error.

• Check for tenant-specific app registration changes
  Since you've synced hundreds of accounts without issue, this might be isolated to a specific tenant. If your app is multi-tenant, verify that the app registration in the problematic user's tenant hasn't been modified (e.g., someone accidentally removed or altered the redirect URI there).

• Rule out URL encoding mismatches
  Sometimes the redirect_uri in your request gets URL-encoded, while the configured URI is stored as plain text. Ensure that when decoded, the request URI matches exactly with the configured one.

• Wait for Azure AD configuration sync (or restart your service)
  Azure AD can sometimes have a small delay propagating configuration changes. If you recently updated your redirect URIs, wait 5-10 minutes and try again. Also, restarting your sync service might clear any cached URI values causing the mismatch.

Since this worked for hundreds of accounts before, the issue is almost certainly a subtle mismatch in the redirect URI for this specific sync attempt—either a recent config change you missed, or a tenant-specific oddity. Let me know if any of these steps help narrow it down!

内容的提问来源于stack exchange，提问作者Connor Paddon