# AADSTS500113: No reply address is registered for the app (fix)

Canonical: https://brambrinkmeier.com/entra/aadsts/500113/
By Bram Brinkmeier. JSON: https://brambrinkmeier.com/api/aadsts/500113.json

**Short answer:** AADSTS500113 means a sign-in request went to the authorize endpoint for an app registration that has no redirect URI (reply address) at all. Entra has no allowed place to send the result and refuses the request, even before anyone signs in. It is a configuration error with low attack value. Add the right platform and redirect URI to the app registration.

**Fix:** Developer or admin: in App registrations, open the app > Authentication > Add Redirect URI, pick the platform that matches the app, and enter the exact URI the app sends. User: you can't fix this yourself; report the app name to whoever set it up.

| Field | Value |
|---|---|
| Code | AADSTS500113 |
| Category | App configuration |
| Type | Configuration error |
| Attack signal | Low: usually configuration or user error |
| In Microsoft's error reference | No (checked 2026-10-30) |
| Verification | lab-reproduced (2026-10-30) |
| Last updated | 2026-10-30 |

## What does AADSTS500113 mean?

Microsoft's [error code reference](https://learn.microsoft.com/entra/identity-platform/reference-error-codes) doesn't list AADSTS500113 (checked 30 October 2026).

In my lab tenant, an unauthenticated authorize request in a browser, for an app registration with no redirect URI, showed this error on the page:

> AADSTS500113: No reply address is registered for the application.

"Reply address" is the older name for a redirect URI. Microsoft's redirect URI page explains why Entra needs one: *"To sign in a user, your application must send a login request to the Microsoft Entra authorization endpoint, with a redirect URI specified as a parameter. The redirect URI is a critical security feature that ensures the Microsoft Entra authentication server only sends authorization codes and access tokens to the intended recipient."* Our reading: with no redirect URI registered at all, there is no allowed place to send the result, so Entra refuses the request.

A Microsoft moderator on [Microsoft Q&A](https://learn.microsoft.com/en-us/answers/questions/183594/aadsts500113-no-reply-address-is-registered-for-th) gave the same reading: *"The error states that the reply URL is not available, hence to fix this, you need to add a valid RedirectURI/ReplyURL in your app registration in AAD."*

Don't confuse it with [AADSTS50011](https://brambrinkmeier.com/entra/aadsts/50011/), which Microsoft does list. Our reading of the difference: 50011 means the app has redirect URIs but the one in the request doesn't match; 500113 means the app has none.

## Reproduced in the lab

In a manual lab test on 30 October 2026, an authorize URL for a lab app registration with no redirect URI was opened in a private browser window, without signing in. Entra showed `AADSTS500113` on its error page with this first line:

> AADSTS500113: No reply address is registered for the application.

That confirms the code and its wording at the authorize endpoint. It also shows the error doesn't need a signed-in user: the request was unauthenticated. It lands in **`SigninLogs`**, and the row was logged under the account that was already signed in to that browser (the lab admin), with client app "Browser". So the user on a 500113 row can be whoever had a session, not someone who typed a password. The KQL below was run on these rows ([how](https://brambrinkmeier.com/methodology/)). The first query found the row. The `AuditLogs` query isn't tested: the export has no audit rows.

## Is it an attack?

No. It is an app registration that is missing its redirect URI.

| Pattern | Likely meaning |
|---|---|
| A new app registration, first test sign-in | The developer created the registration and never added a platform. |
| A desktop or mobile app (for example an Android app) fails on first interactive sign-in | The registration has no **Mobile and desktop applications** platform. Users report this on [Microsoft Q&A](https://learn.microsoft.com/en-us/answers/questions/183594/aadsts500113-no-reply-address-is-registered-for-th) (Android) and the [Icewolf blog](https://blog.icewolf.ch/archive/2021/07/06/aad-delegated-login-fix-error-aadsts500113-no-reply-address-is/) (delegated login). |
| An app registration made for a background service is now used for user sign-in | Likely: app-only (client credentials) apps don't use the authorize endpoint, so they never needed a redirect URI. Microsoft doesn't say this; a user commenter on the same Q&A thread does. |
| An app that worked and now fails | Someone removed its redirect URIs. Check the audit log (query below). |

An attacker who sends this request probably learns only that the app has no redirect URI. Nobody is signed in and nothing is issued.

## How do I find it in my logs (KQL)?

Microsoft doesn't document which sign-in table 500113 is logged in. The lab run above logged it in `SigninLogs`, under the account that already had a session in the browser. Check both user sign-in tables:

```kusto
union withsource=SourceTable SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d)
| where ResultType == "500113"
| summarize Rows = count(), LastSeen = max(TimeGenerated) by SourceTable, AppId, AppDisplayName
```

The audit log is more useful. If the app used to work, find who changed its registration:

```kusto
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName == "Update application"
| mv-expand Target = TargetResources
| where tostring(Target.displayName) == "<app display name>"
| mv-expand Prop = Target.modifiedProperties
| project TimeGenerated,
    Actor = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)),
    Property = tostring(Prop.displayName),
    OldValue = tostring(Prop.oldValue),
    NewValue = tostring(Prop.newValue)
| sort by TimeGenerated desc
```

The table reference documents `TargetResources` and `InitiatedBy` only as dynamic columns. The field names inside them (`displayName`, `modifiedProperties`, `user.userPrincipalName`) aren't documented there, and neither is the operation name `Update application`. Look for a property whose old value held URLs and whose new value is empty.

## How do I fix AADSTS500113?

**For the user:** you can't fix this yourself. Report the app name to whoever set it up.

**For developers and admins:** add a platform and redirect URI to the app registration. Microsoft's steps:

1. In the Microsoft Entra admin center, in **App registrations**, select the application.
2. Under **Manage**, select **Authentication**.
3. Select **Add Redirect URI** (on the **Redirect URI configuration** tab).
4. Pick the platform that matches the app: **Web**, **Single-page application**, **iOS / macOS**, **Android** or **Mobile and desktop applications**.
5. Enter or select the redirect URI, then select **Configure**.

Microsoft: *"For Web and Single-page applications, you specify a redirect URI manually. For Mobile and desktop platforms, you select from generated redirect URIs."* Use the exact URI the app sends. If it then fails with [AADSTS50011](https://brambrinkmeier.com/entra/aadsts/50011/), the URI you added doesn't match the one in the request.

If the app is only meant to run as a background service, it shouldn't be sending users to the authorize endpoint at all. Our reading: switch it to the client credentials flow rather than adding a redirect URI it doesn't need.

## Evidence

Reproduced in a lab tenant on 2026-10-30 (Authorize request in a browser against a lab tenant; scenario: Authorize request for an app with no reply address (browser)). First line returned:

> AADSTS500113: No reply address is registered for the application.

Sign-in log row read: 2026-10-30. KQL run against the exported lab rows: 2026-10-30.

Lab-run rows naming this code (1; full list at https://brambrinkmeier.com/lab-runs.json):

| Date | Scenario | Expected | Got | Message (first line) |
|---|---|---|---|---|
| 2026-10-30 | Authorize request for an app with no reply address (browser) | 500113 | 500113 | AADSTS500113: No reply address is registered for the application. |

## Sources

1. [Microsoft Entra authentication and authorization error codes](https://learn.microsoft.com/entra/identity-platform/reference-error-codes)
2. [How to add a redirect URI to your application](https://learn.microsoft.com/entra/identity-platform/how-to-add-redirect-uri)
3. [Microsoft Q&A: AADSTS500113: No reply address is registered for the application](https://learn.microsoft.com/en-us/answers/questions/183594/aadsts500113-no-reply-address-is-registered-for-th)
4. [Icewolf blog: AAD delegated login, fix error AADSTS500113](https://blog.icewolf.ch/archive/2021/07/06/aad-delegated-login-fix-error-aadsts500113-no-reply-address-is/)
5. [SigninLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs)
6. [AuditLogs table reference (Azure Monitor)](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs)

## Related codes

[AADSTS50011](https://brambrinkmeier.com/entra/aadsts/50011/), [AADSTS700051](https://brambrinkmeier.com/entra/aadsts/700051/), [AADSTS700054](https://brambrinkmeier.com/entra/aadsts/700054/), [AADSTS700016](https://brambrinkmeier.com/entra/aadsts/700016/)

## License and citation

CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). CC BY 4.0 covers the author's own text and classification fields. Quoted Microsoft error wording belongs to Microsoft, is quoted with its source and can change.

Cite as: Bram Brinkmeier, "AADSTS500113: No reply address is registered for the app (fix)", https://brambrinkmeier.com/entra/aadsts/500113/ (CC BY 4.0), last updated 2026-10-30.