/
HiveMQ Cloud Control Center - OIDC Authentication Issue with Azure Entra ID

HiveMQ Cloud Control Center - OIDC Authentication Issue with Azure Entra ID

Issue Summary

When migrating to a new HiveMQ Cloud cluster with OIDC authentication configured through Azure Entra ID, the Control Center login may fail even though the Azure App Registration has been updated with the new cluster's callback URI.

Symptoms

  • Control Center login fails on newly created HiveMQ Cloud cluster

  • OIDC authentication with Azure Entra ID does not work

  • Existing clusters with similar OIDC configuration continue to work normally

  • New FQDN callback URI has been added to Azure App Registration

Root Cause

The callback URI was not properly applied to the specific Azure App Registration Client ID being used by the HiveMQ Cloud cluster for OIDC authentication.

Resolution Steps

Step 1: Identify the Client ID

Locate the Client ID being used for OIDC authentication in your HiveMQ Cloud cluster configuration. The Client ID is a unique identifier provided by Azure Entra ID during the App Registration process.

Step 2: Verify Azure App Registration Configuration

  1. Log into the Azure Portal

  2. Navigate to Azure Active Directory (Entra ID)

  3. Select "App registrations"

  4. Locate the App Registration with the Client ID being used by your cluster

  5. Select "Authentication" from the left menu

Step 3: Apply the Callback URI

  1. In the Authentication section, locate the "Redirect URIs" section

  2. Verify that the callback URI for your new cluster's Control Center is listed

  3. The callback URI should follow this format:

    https://<your-cluster-fqdn>/callback

  4. If the URI is present but authentication still fails, remove and re-add the callback URI

  5. Click "Save" to apply the changes

Step 4: Test Control Center Access

  1. Wait 2-3 minutes for the Azure configuration changes to propagate

  2. Navigate to your HiveMQ Cloud Control Center URL

  3. Attempt to log in using OIDC authentication

  4. Verify successful authentication and access to the Control Center

Prevention and Best Practices

During Cluster Migration

  • Document all Client IDs used across your HiveMQ Cloud clusters

  • Create a checklist of Azure App Registration updates required for new clusters

  • Test OIDC authentication immediately after adding new callback URIs

  • Allow sufficient time for Azure configuration changes to propagate before testing

Configuration Management

  • Maintain documentation of which Client IDs are associated with which clusters

  • Use consistent naming conventions for callback URIs that include cluster identifiers

  • Verify callback URI format matches exactly what HiveMQ Cloud expects

  • Consider using separate App Registrations for different environments (dev, staging, production)

Post-Migration Validation

  • Create a post-migration checklist that includes Control Center access verification

  • Test authentication with multiple user accounts to ensure proper configuration

  • Document the specific Client ID and callback URI configuration for each cluster

Additional Notes

  • Changes to Azure App Registration authentication settings may take a few minutes to propagate

  • Ensure that the callback URI format exactly matches the cluster's FQDN

  • Multiple callback URIs can be configured in a single App Registration to support multiple clusters

Related Information

For more information about HiveMQ Cloud, visit the HiveMQ documentation.

Last Updated: January 2026
Product: HiveMQ Cloud
Category: Authentication, Control Center, OIDC
```