Troubleshooting Entra ID Authentication
Factry Historian
No reply address provided
- Either the redirect URI is wrong, the BaseURL is wrong or the Factry Historian was not restarted after the last change of the BaseURL.
Admin permissions needed
- A Microsoft Entra ID administrator must grant permission for Historian to receive login data from Entra ID. This typically appears as a pop-up requesting admin consent, with an option to “Consent on behalf of the entire organization.”
Error on login: Missing privileges: contact your system administrator
- If no group mapping is enabled in Factry Historian (see Configure group mapping) → You must manually add the user to a group in Factry Historian to grant privileges. A user without privileges is not able to log in.
- If group mapping is enabled in Factry Historian → Verify the group mapping configuration, and if the user is part of the mapped group in Entra ID.
When group mapping is active, manually adding users to groups in Historian will not work, group membership is managed entirely through Entra ID.
Error AADSTS50011
The redirect URI 'https://xxxx:xxxx/api/auth/Microsoft/callback' specified in the request does not match the redirect URIs configured for the application.
The Factry Historian authentication base URL does not match the redirect URL configured in the Entra ID app registration. Learn more here.
Verify:
- In the Azure app registration – a incorrect redirect URI may have been saved: e.g. a wrong Historian base URL or an incorrect authentication provider name was given in the URI.
- In Factry Historian – if the authentication base URL (General settings > Authentication) was changed, but Historian was not restarted, the new URL was not applied yet. Restart Factry Historian via the CLI or contact Factry support.
Grafana
No reply address provided
- Check that the redirect URIs in Microsoft Entra ID are correct (Grafana requires two redirect URIs).
- Check that the root_url in grafana.ini is correct.
Need admin approval
- This means an administrator must grant the necessary permissions to the Grafana app in the Microsoft Entra ID configuration.
- Whether this is required depends on your organization’s Entra ID domain settings.
Redirect URI issue
In Azure App registration, one or both Redirect URIs are incorrect.
Root URL issue
In Grafana, root URL is misconfigured.
- View root url in Grafana via Home > Administration > General > Settings, search for root_url
- To change, edit file /etc/grafana/grafana.ini on the server.
Approval needed
First login may need an Azure admin to approve app access.
Duplicate usernames
If a local Grafana user has the same username as the Entra ID user, login fails.
- Remove or rename the local user.
Too many security groups
Users with >150 groups they belong to exceed request size.
- Use App roles instead of security groups.
Don't spot your error? Contact Factry support.