Microsoft Login common/wrongplace Redirect – Microsoft-Side Authentication Handling Issue

[abraunegg]

Some users are currently reporting that during reauthentication they are being redirected to:

https://login.microsoftonline.com/common/wrongplace

with a message such as:

“This is not the right page. Please close this app or window and try again.”

Others may briefly see a page stating:

“You have reached a page that is not normally shown. Microsoft will never ask you to copy or share this URL.”

✅ Important Clarification

This behaviour is not caused by any change in the onedrive client, nor by incorrect scopes, permissions, or configuration.

The client continues to use:

• The correct Microsoft Entra OAuth v2.0 authorisation endpoint
• The officially supported public-client redirect URI (…/oauth2/nativeclient)
• Standard delegated Microsoft Graph scopes
• A fully valid authorisation code login flow

If this were a permission or scope issue, Microsoft would show a clear AADSTS error message. That is not what is happening here.

This is a Microsoft-side redirect handling issue affecting the nativeclient flow for some users and tenants, and similar reports are now appearing in other Microsoft-connected applications.

✅ What To Do If You Hit This

Please try the following in order:

1. Use a clean browser session

Open the authorisation link in:

• A private / incognito window, or
• A fresh browser profile

Make sure no login or security extensions are interfering.

2. Copy the redirect URL immediately when it appears

When you reach the page that says:

“You have reached a page that is not normally shown…”

Do this immediately:

1. Click the address bar
2. Copy the FULL URL
3. Paste it straight back into the onedrive prompt

If the page later redirects to /common/wrongplace, that is OK — the valid authorisation code was already in the previous URL.

3. If you only ever see /common/wrongplace

Try the following:

• Press the Back button once and copy the URL from the previous page
• Try a different browser (Chrome vs Firefox vs Edge)
• Try a different network (home vs VPN vs mobile tether)

Corporate proxies and security gateways are known to interfere with this process.

🏢 Business / School Account Users

If you are using a work or school account, please ask your Microsoft 365 / Entra administrator to check:

• Public client flows are permitted
• No new Conditional Access or security policies are blocking interactive authentication

If other Microsoft-connected apps are also failing to authenticate, this confirms the issue is tenant-side.

📞 If you only ever see /common/wrongplace, you may need to contact Microsoft Support

If the redirect never shows the nativeclient?code=... URL — even after trying a clean browser session, different browsers, and different networks — the issue is occurring inside Microsoft’s login system and must be raised with Microsoft.

How to get support:

For personal Microsoft accounts (Outlook.com / Hotmail / Live)

You can open a support request here:
👉 https://support.microsoft.com/contactus/

When opening the ticket, include:

• A clear description that login to https://login.microsoftonline.com/common/oauth2/nativeclient is redirecting to /common/wrongplace.

• The approximate time and timezone when the failure occurs.

• Screenshots of:

  • The full address bar URL at the moment it redirects (you may redact the code= parameter).
  • The /common/wrongplace page.

• The browser and operating system used.

• Whether you tried private/incognito mode and a second browser.

For work or school (Azure AD / Microsoft 365) accounts

Support must be raised by your organisation’s Microsoft 365 / Entra administrator.

Your admin should:

1. Go to the Microsoft 365 Admin Center
   👉 https://admin.microsoft.com/

2. Navigate to Support → New Service Request

3. Report that:

   “Interactive OAuth2 login to
   https://login.microsoftonline.com/common/oauth2/nativeclient
   is being redirected to /common/wrongplace.
   This prevents delegated Graph authentication for desktop/native applications.”

Provide Microsoft with:

• Timestamp of the failure (with timezone)
• Tenant ID
• User UPN (email) experiencing the issue
• Screenshot of the last valid redirect before /common/wrongplace
• Whether Conditional Access or MFA is configured

This gives Microsoft enough telemetry to trace the failed redirect inside their infrastructure.

❗ A note about seeking support from this project

Please be aware that the /common/wrongplace redirect originates entirely within Microsoft’s authentication infrastructure. The onedrive client never receives a code, an error, or any diagnostic information that would allow me — or anyone else involved in this project — to troubleshoot or fix the issue.

As a result, seeking support from me directly or from this GitHub project for this specific problem will unfortunately lead to a dead end. There is nothing in the client code, configuration, or scope set that can influence or correct Microsoft’s redirect behaviour. The only party with access to the affected systems, logs, and telemetry is Microsoft themselves.

For this reason, affected users must contact Microsoft Support (or, for work/school accounts, ask their Microsoft 365 / Entra administrator to open a support ticket) as described above. This is the only viable path to resolution.

Technical Cause of Issue

Microsoft has added the following code to the "nativeclient" redirectURL landing page:

<div>
<h2>This page is not normally shown and could be a sign of a phishing attempt. The URL contains your password. Close this page immediately and do not copy or share the URL with anyone.</h2>
<script type="text/javascript" nonce='oYPBzaVlmbvRb_NCxBqXeg'>
var redirectUrl = 'https://login.microsoftonline.com/common/wrongplace';
setTimeout(function() {
window.location.replace(redirectUrl);
}, 3000);
</script>
</div>

This introduces a 3 second timeout, before the javascript redirection to the https://login.microsoftonline.com/common/wrongplace occurs.

When this piece of code was introduced, Microsoft had a different value (10 seconds?) and has since dropped this to 3 seconds (3000 value above).

Only Microsoft can generate a fix of this issue.

Workaround 1

Potentially disable javascript for your browser for the https://login.microsoft.com/ URL. This potentially stops the offending javascript from running and may allow you to capture the URL as intended.

Workaround 2

If using a Business Account or SharePoint strongly consider switching to using 'Device Authentication' or 'Intune' for your authentication method. Please read https://github.com/abraunegg/onedrive/blob/master/docs/usage.md#authorise-the-application-with-your-microsoft-onedrive-account for details

These alternate authentication methods do not work with Microsoft Personal accounts.