Which redirect URI does PnP PowerShell need for -Interactive?

Add http://localhost under the Mobile and desktop applications platform. PnP adds a random port, which Entra ID ignores for localhost. The PnP guide to registering an Entra ID application shows the manual setup.

Should I use the nativeclient URI or http://localhost?

For PnP PowerShell, http://localhost is required. The nativeclient URI is for apps with an embedded browser. Keeping both is fine, and PnP's own registration cmdlet adds both.

Does Connect-PnPOnline -DeviceLogin need a redirect URI?

No. Device code sign-in doesn't use one. Turn on Allow public client flows on the app's Authentication page instead, or you'll get AADSTS7000218.

AADSTS500113: No Reply Address Is Registered for the App

On 10/09/2026 I created a new app in Microsoft Entra ID for PnP PowerShell, ran Connect-PnPOnline -Interactive with its client ID. Instead of a working sign-in, the PnP login window said AADSTS500113: No reply address is registered for the application.

The cause is simple: the app had no redirect URI, so Entra ID had nowhere to send the token. Below I’ll show the fix with screenshots from my tenant, explain which redirect URI PnP PowerShell really needs, and cover device code sign-in and other tools.

Quick answer: Your app registration has no redirect URI. In the Microsoft Entra admin center, open Entra ID > App registrations > your app > Authentication > Redirect URI configuration > + Add Redirect URI > Mobile and desktop applications. Check the nativeclient URI, type http://localhost in the custom box, select Configure, and connect again.

Table of Contents:

What AADSTS500113 means

This is the command I ran:

Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Marketing" `
    -ClientId "00000000-0000-0000-0000-000000000000" -Interactive

And this is what the Please login for PnP PowerShell window showed, with the IDs trimmed:

Sorry, but we're having trouble signing you in.

AADSTS500113: No reply address is registered for the application.

Troubleshooting details
Request Id: <GUID>
Correlation Id: <GUID>
Timestamp: 2026-10-09T18:57:01Z
Message: AADSTS500113: No reply address is registered for the application.

AADSTS500113 no reply address is registered for the application in the Please login for PnP PowerShell window

A redirect URI (Microsoft’s older name is reply URL) is the address where Entra ID sends you and your token after sign-in. Entra ID only sends tokens to addresses listed on the app registration. My app had none, so the sign-in stopped right there.

You’ll usually hit this right after building your own app for PnP PowerShell, which has been required since September 2024. The New registration page leaves the Redirect URI field optional, and it’s easy to skip. My guide to connecting to SharePoint Online using PowerShell walks through the full app setup.

Keep the Correlation Id and Timestamp from the Troubleshooting details. An admin can match them to the failed entry in the Entra sign-in logs.

Which redirect URI does PnP PowerShell need?

My screenshots below check the suggested nativeclient URI, while PnP’s own setup guide says to add http://localhost. So I checked what PnP PowerShell actually sends:

PnP PowerShell 3.x opens your default browser for -Interactive and asks Entra ID to return the token to http://localhost on a random free port.
PnP PowerShell 2.x on Windows showed the embedded Please login for PnP PowerShell window from my screenshot. It also used http://localhost with a random port.
Entra ID ignores the port on localhost redirect URIs, so one http://localhost entry covers every port.

So http://localhost is the URI that matters. The nativeclient URI is Microsoft’s suggestion for apps with an embedded browser. It’s harmless, and PnP’s own registration cmdlet adds it too, but on its own it won’t match PnP’s request. You’d likely trade AADSTS500113 for AADSTS50011, the reply URL mismatch error.

How you connect	What PnP sends	What to add to the app
`-Interactive`	`http://localhost:<port>`	`http://localhost` under Mobile and desktop applications
`-OSLogin` (Windows sign-in broker)	Broker redirect URI	`ms-appx-web://microsoft.aad.brokerplugin/<client ID>`
`-DeviceLogin`	No redirect URI	Allow public client flows turned on

How to fix AADSTS500113 in the Microsoft Entra admin center

You need to own the app registration or hold a role that manages app registrations, such as Application Administrator or Cloud Application Administrator.

Step 1. Sign in to the Microsoft Entra admin center and go to Entra ID > App registrations > All applications. Open the app whose Application (client) ID matches the -ClientId you passed to PnP.