Accessing https://viewer.diagrams.net directly returns the same AADSTS50011 error.

We are unable to authenticate to viewer.diagrams.net using Microsoft 365 ans only with this address. Authentication with sharepoint is ok, we can use app.diagrams.net with any trouble.

But, when generating a link with Publish > Link, instead of app.diagrams.net we have viewer.diagrams.net.

Authentication with viewer.diagrams.net consistently fails with the following Azure AD error:

AADSTS50011
The redirect URI https://viewer.diagrams.net/ms365 specified in the request does not match the redirect URIs configured for the application 417a451a-a343-4788-b6c1-901e63182565.

The issue affects multiple users and is reproducible regardless of the device or network used.

We already have verified the Azure AD application configuration associated with App ID 417a451a-a343-4788-b6c1-901e63182565 and :

• the Redirect URI https://viewer.diagrams.net is correctly registered;
• the Microsoft 365 authentication flow requests the correct Redirect URI;
• no recent deployment introduced this mismatch.
• Microsoft Entra ID is operating normally.
• MFA is functioning correctly.
• Conditional Access is not blocking authentication.
• Multiple users, devices and networks are affected.
• Accessing https://viewer.diagrams.net directly returns the same AADSTS50011 error.
  Environment:
• Microsoft 365 / Microsoft Entra ID
• Error code: AADSTS50011
• Azure Application ID: 417a451a-a343-4788-b6c1-901e63182565

Browser:
Chrome, FireFox and Edge
The link to generate the viewer.diagrams.net link is via Publish > Link

Is this issue occurring when using draw.io integrated within SharePoint/OneDrive, or through the standalone web app at app.diagrams.net with a file stored in OneDrive?

Both with draw.io integrated and through the standalone web app

Have you tried manually replacing 'viewer.diagrams.net' with 'app.diagrams.net' in the generated URL as a workaround — does that resolve the authentication issue?

When replacing 'viewer.diagrams.net' with 'app.diagrams.net' it is working fine

Is this a recent regression, i.e., did viewer.diagrams.net links with Microsoft 365 authentication work previously for you?

I did not try this before.

Start at the Publish > Link flow and trace how it generates viewer.diagrams.net URLs, then compare the Microsoft 365 authentication entry points for viewer.diagrams.net and app.diagrams.net. Reproduce the AADSTS50011 redirect mismatch with the listed Azure application ID and verify the registered redirect URI. Done means generated viewer links authenticate successfully without requiring a manual host replacement.