Microsoft Entra ID – Callback URL Blocked by APIM / Application Gateway

Hi @Anoop Issac (G10X, IND) ,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Yes, APIM imposes a ~2 KB query-string limit which is being exceeded. The fix is to use Azure AD’s supported form_post response mode so the code is sent in the body, not the URL. No APIM/AppGW setting can increase the URL length limit – the solution is to change the OAuth flow accordingly.

Reference for limits:

• Azure API Management limits
• Understanding Azure API Management service limits

Recommended Solution: Use response_mode=form_post The most robust and secure way to fix this is to change the way Entra ID sends the authorization code back to your application. Instead of using the default query mode (which puts the code in the URL), you should use form_post.

• How it works: When you initiate the login request to Entra ID, add the parameter response_mode=form_post.
• Benefits: * Bypasses URL Limits: The authorization code is sent in the HTTP POST body, which has a much higher limit (up to 2MB or more on WAF) than the URL query string.
  • Security: Tokens and codes are not stored in browser history or server access logs because they are not part of the URL.
• Requirement: Your backend (Azure Container App) must be configured to accept a POST request on your callback/redirect URI (e.g., /callBack).
• Reference: Microsoft Identity Platform Response Modes

In Azure API Management (APIM) and Application Gateway, there are indeed limits on the length of URLs and query strings. While the specific limits can vary based on configurations and the version of the services, it is common for these services to impose a maximum URL length that can be around 2048 characters. Given your observation that the issue arises when the query parameter length exceeds approximately 2200 characters, it is likely that this is causing the blocking behavior you are experiencing.

To address your questions:

1. URL/query string length limit: Yes, APIM and Application Gateway have URL length limits that could be causing the issue you are encountering.
2. Configuration changes: You may need to consider breaking up the query parameters into smaller segments or using POST requests instead of GET requests for passing large amounts of data. Additionally, reviewing the configuration settings in APIM and Application Gateway for any specific limits or settings related to query string lengths would be beneficial.
3. Similar issues: While I cannot provide specific cases, it is not uncommon for users to encounter issues with long query strings in various authentication flows, including those involving Microsoft Entra ID. It may be helpful to check community forums or support channels for similar experiences.

For further assistance, reviewing the official documentation on APIM and Application Gateway might provide additional insights into configuration options and limitations.