title: Error: The reply URL specified in the request does not match the reply URLs configured for the application
body: <p>I'm trying to figure out the cause of a certain error I am getting in the middle of the OAuth flow (with login.microsoftonline.com as IDP) in order to get access to a page.</p>
  
  <p>The error is:</p>
  
  <blockquote>
    <p>AADSTS50011 (The reply URL specified in the request does not match the reply URLs configured for the application: '89bee1f7-5e6e-4d8a-9f3d-ecd601259da7'.</p>
  </blockquote>
  
  <p>Looking at the requests going out, I do see a request corresponding to that:</p>
  
  <p><a href="https://login.microsoftonline.com/common/oauth2/authorize?response_type=id_token&amp;client_id=89bee1f7-5e6e-4d8a-9f3d-ecd601259da7&amp;redirect_uri=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Foauth2%2Fauthorize&amp;state=XXX&amp;client-request-id=YYY&amp;x-client-SKU=Js&amp;x-client-Ver=1.0.15&amp;nonce=ZZZ&amp;iframe-request-id=XXX" rel="nofollow noreferrer">https://login.microsoftonline.com/common/oauth2/authorize?response_type=id_token&amp;client_id=89bee1f7-5e6e-4d8a-9f3d-ecd601259da7&amp;redirect_uri=https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Foauth2%2Fauthorize&amp;state=XXX&amp;client-request-id=YYY&amp;x-client-SKU=Js&amp;x-client-Ver=1.0.15&amp;nonce=ZZZ&amp;iframe-request-id=XXX</a></p>
  
  <p>I've seen a few posts about AADSTS50011, some saying this may be a Microsoft issue and others saying the client ID in question needs to be registered. But my code is not using this mysterious client ID from anywhere and I'd like to know where it is coming from.</p>
  
  <p>I'm not certain, but it seems this request may be coming from Javascript from or related to <a href="https://webshell.suite.office.com/iframe/TokenFactoryIframe" rel="nofollow noreferrer">https://webshell.suite.office.com/iframe/TokenFactoryIframe</a>.</p>
  
  <p>By the way, in the exchange of requests I see what looks like the proper client ID also being used (00000002-0000-0ff1-ce00-000000000000), and authentication seems to be succeeding. I even see the page in question start to load, but then in a few seconds the error comes up.</p>
  
  <p>UPDATE: Related to this question is what the first above URL is actually doing. It is a link to /authorize whose redirect URI is to the same location. This seems odd, is it to be expected in normal OAuth flow? If so, why?</p>