Description
This article describes how to fix Error: AADSTS50011 while connecting to FortiSASE VPN, which is configured with SAML SSO.
Scope
FortiClient, FortiSASE, Azure.
Solution
This error occurs if the redirect URI configured in the FortiSASE and Microsoft Entra app registration do not match.
Copy the redirect URI, i.e. ms-appx-web://Microsoft.AAD.BrokerPlugin/65033a96-187a-46e9-a64c-43401652d525.
To fix this issue, navigate to APP registration for the FortiSASE application in Azure and select Authentication.
Select Add a platform and select 'mobile and desktop applications', then paste the 'ms-appx-web' URI under the custom redirect URL, which was received in error while connecting the VPN.
Note: Paste the complete 'ms-appx-web' URI in customer redirect URL. For example: ms-appx-web://Microsoft.AAD.BrokerPlugin/65033a96-187a-46e9-a64c-43401652d525
After configuring the custom redirect URL, save the changes in the Azure portal, and try reconnecting the FortiSASE VPN.
