---
title: Troubleshooting Entra ID Authentication
slug: how-tos/qOg3-troubleshooting-entra-id-authentication
createdAt: 2025-10-20T08:56:13.831Z
---

## Factry Historian

### No reply address provided

- Either the **redirect URI** is wrong, the **BaseURL** is wrong or the **Factry Historian** was not restarted after the last change of the BaseURL.

### Admin permissions needed

- A **Microsoft Entra ID administrator** must grant permission for Historian to receive login data from Entra ID. This typically appears as a pop-up requesting admin consent, with an option to **“Consent on behalf of the entire organization.”**

### Error on login: Missing privileges: contact your system administrator

- If **no group mapping is enabled** in Factry Historian (see [Configure group mapping](docId:8fvF2zGAngAF70QY5yYeC))
  → You must manually add the user to a group in Factry Historian to grant privileges. A user without privileges is not able to log in.
- If **group mapping is enabled** in Factry Historian
  → Verify the group mapping configuration, and if the user is part of the mapped group in Entra ID.

:::hint{type="warning"}
When group mapping is active, **manually adding users to groups in Historian will not work,** group membership is managed entirely through Entra ID.
:::

### Error AADSTS50011

*The redirect URI *`'https://xxxx:xxxx/api/auth/Microsoft/callback'`* specified in the request does not match the redirect URIs configured for the application.*

The Factry Historian authentication base URL does not match the redirect URL configured in the Entra ID app registration. [Learn more here](https://aka.ms/redirectUriMismatchError).

Verify:

1. In the **Azure app registration** – a incorrect redirect URI may have been saved: e.g. a wrong Historian base URL or an incorrect authentication provider name was given in the URI.
2. In **Factry Historian** – if the authentication base URL **(General settings > Authentication)** was changed, but Historian was not restarted, the new URL was not applied yet. Restart Factry Historian via the CLI or contact Factry support.

## Grafana

### No reply address provided

- Check that the **redirect URIs** in Microsoft Entra ID are correct (Grafana requires two redirect URIs).
- Check that the `root_url` in `grafana.ini` is correct.

### Need admin approval

- This means an administrator must grant the necessary permissions to the Grafana app in the Microsoft Entra ID configuration.
- Whether this is required depends on your organization’s Entra ID domain settings.

### Redirect URI issue

In Azure App registration, one or both Redirect URIs are incorrect.

### Root URL issue

In Grafana, root URL is misconfigured.

- View root url in Grafana via **Home > Administration > General > Settings**, search for `root_url`
- To change, edit file `/etc/grafana/grafana.ini` on the server.

### Approval needed

First login may need an Azure admin to approve app access.

### Duplicate usernames

If a local Grafana user has the same username as the Entra ID user, login fails.

- Remove or rename the local user.

### Too many security groups

Users with >150 groups they belong to exceed request size.

- Use **App roles** instead of security groups.

:::hint{type="info"}
Don't spot your error? Contact Factry support.
:::