Microsoft Entra ID external login redirect to /signin-microsoft returns resource not found

[9989663675]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

After successful authentication with Microsoft Entra ID, the user is redirected
to the configured redirect URI (/signin-microsoft) with a valid authorization
code and state.

However, the browser displays the error:
"The resource you are looking for has been removed, had its name changed, or is temporarily unavailable."

Expected Behavior

After redirect, the application should successfully exchange the authorization
code for tokens and complete external login.

Steps To Reproduce

1. User clicks "Sign in with Microsoft"
2. User authenticates successfully in Entra ID
3. Entra ID redirects back to https://login.smartcursors.com/signin-microsoft?code=...
4. Application shows "resource not found" error

Exceptions (if any)

After redirect, the application should successfully exchange the authorization
code for tokens and complete external login.

.NET Version

dotnet core 2.0

Anything else?

This application is not using .NET Core 2.0 or IdentityServer4.
We are using ASP.NET Core Identity with Microsoft Entra ID as an external login provider.

[9989663675]

Thank you for the response.

Due to security and tenant-specific configuration constraints, we are currently unable to share a public minimal repro project, as the issue depends on Microsoft Entra ID tenant configuration and external redirect behavior.

However, we are actively preparing a simplified repro by removing all business logic and confidential details, while keeping only the authentication flow. We will share a public GitHub repository as soon as it is ready.

In the meantime, please let us know if any specific logs, middleware configuration details, or OpenID Connect event traces (such as OnAuthorizationCodeReceived, OnTokenValidated, or related diagnostics) would help move the investigation forward.

[willdean]

This is is because Entra is now (for some logins) returning codes so long that the query in the callback URL exceeds 2048 characters. On Azure App Service, at least, this exceeds the default limit, and the request fails before it even reaches your app.

The solution is to increase the max query length, which you have to do in web.config, like a neanderthal would...

Something like this:

<system.webServer>
    <security>
    <requestFiltering>
      <requestLimits  maxQueryString="4096" />
    </requestFiltering>
  </security>
</system.webServer>

Clearly Entra should be asked to stop doing this

[MackinnonBuck]

@jmprieur It sounds like customers are hitting this query string character limit on Azure App Service when using Entra ID. Would you be able to share this feedback with the right Entra ID folks? Thanks.

Closing this out as it's not an issue with ASP.NET Core.

[9989663675]

Thanks for the suggestion.

After updating the deployment and applying the maxQueryString increase in web.config, the Entra callback issue is now resolved and the login flow is working as expected.

Appreciate your help