Process Studio Login Failure with the SSO user Due to Azure AD Reply URL Mismatch (AADSTS50011)

Process Studio Login Failure with the SSO user Due to Azure AD Reply URL Mismatch (AADSTS50011)

Warning
Issue :

Users were unable to login to Process Studio using SSO authentication and encountered the below error from Azure AD:

AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application.

Additionally, Process Studio logs showed:

  • Authentication : HTTP Status - 400

  • SSO Callback server started on port 2611

Alert
Error Message :

AADSTS50011: The reply URL 'http://localhost:2611/callback' specified in the request does not match the reply URLs configured for the application.

Environment

  • Process Studio Version: 8.4.0

  • Authentication Protocol: SAML 2.0

  • Identity Provider: Microsoft Azure AD

Info
Root Cause :

Process Studio uses a local callback server during the SSO authentication flow and sends the below redirect URI during login:

http://localhost:2611/

However, this URL was not configured in the Azure AD application Reply URL/Redirect URI settings. Due to this mismatch, Azure AD rejected the authentication request and returned HTTP 400 with error code AADSTS50011.

Observations from Logs

SSO Callback server started on port 2611
Authentication : HTTP Status - 400

This confirmed that:

  • Process Studio started successfully.

  • The local SSO callback server was running correctly.

  • Authentication failed at Azure AD validation stage due to redirect URI mismatch.

Idea
Solution :

Add the localhost callback URL in the Azure AD application Reply URL/Redirect URI configuration.

Required Redirect URI

http://localhost:2611/

Steps to Configure in Azure AD

  1. Login to Azure Portal.

  2. Navigate to:
    Azure Active Directory → App Registrations

  3. Open the required application.

  4. Go to:
    Authentication

  5. Under Redirect URIs / Reply URLs, add:

    http://localhost:2611/

  6. Save the configuration.

  7. Restart Process Studio and retry login.

Result

After adding the localhost callback URL in Azure AD:

  • SSO login started working successfully.

  • Users were able to authenticate in Process Studio without errors.

Additional Notes

  • The Redirect URI must match exactly.

  • Ensure no firewall or proxy restrictions block localhost port 2611.

  • Browser cache/session cleanup may be required after configuration changes.