When signing into Entra ID as the Identity Provider (IdP) and Okta as the Service Provider (SP), the following error message appears:

Sorry, but we're having trouble signing you in.

AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application:

• Single Sign-On (SSO)
• Identity providers (IdP)
• Entra ID

• The Reply URL (Assertion Consumer Service URL) configured in Entra ID is incorrect, or a custom domain was added/removed from Okta.
• The session is initiated from Okta using a domain other than the domain in the Reply URL configured in Entra ID.

Cause 1

The session is initiated from Okta using a domain other than the domain in the Reply URL configured in Entra ID.

• For example, the user initiates the session from example.okta.com (default domain), but the Reply URL in Entra ID is configured as customexample.com (custom domain) or vice versa.
  • To resolve the issue, ensure the session is initiated from Okta with the same domain configured as the Reply URL in Entra ID. 

Cause 2

Verify Reply URL (Assertion Consumer Service URL) is correct.

1. Navigate to the Entra admin center.
2. Select the Enterprise Application that is utilized for IdP in Entra ID.
3. Within the application, select Single sign-on.

4. Navigate to Basic SAML Configuration and click Edit.

5. Verify that there is a value in the Reply URL (Assertion Consumer Service URL) and ensure that the value is correct.

Related References

• Error AADSTS50011 with SAML authentication