Entra ID generates an error when a user attempts to authenticate with Okta as an external authentication method (EAM) because an incorrect Redirect Uniform Resource Identifier (URI) exists in the Okta application registration. Administrators resolve this issue by setting the application registration to the WEB type and verifying the Redirect URI configuration. Entra ID returns the following error during authentication:

We couldn't complete your verification

Message: AADSTS5001255: Failed to validate authorization url of external authentication provider.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Entra ID
• External Authentication Method (EAM)

An incorrect Redirect Uniform Resource Identifier (URI) exists in the Entra ID configuration for the Okta application registration.

How is the Redirect URI configured in Entra ID?

Configure the application registration as a WEB type and verify the Redirect URI matches the correct environment value.

1. In Entra ID, set the application registration to the WEB type.
2. Verify the Redirect URI contains the correct value for the environment:
   • Production: https://<org-name>.okta.com/oauth2/v1/authorize
   • Preview: https://<org-name>.oktapreview.com/oauth2/v1/authorize

Related References

• Configure Okta as an external authentication method for Microsoft Entra ID