Troubleshooting

Symptom	Likely cause	Fix
Entra ID shows "The redirect URI ... does not match" and the URI starts with `http://`	UMP does not receive `X-Forwarded-Proto: https`	Check that the WAF sends the header. Use `ASPNETCORE_FORWARDEDHEADERS_LOG` (Step 4 Verify Deployment)
Entra ID shows a redirect URI with the VM name or an internal host name	The WAF rewrites the Host header.	Set override with new host name to No (Step 1- Configure WAF)
Sign-in succeeds but the next page asks to sign in again	Cookies are not marked secure, so the browser drops them.	Same as the first row: UMP-365 must view the request as HTTPS
`/authenticate` ends in "too many redirects"	The Customer portal does not trust the forwarded headers.	Add `ASPNETCORE_FORWARDEDHEADERS_ENABLED` (Step 2-Configure the UMP-365 VM). Check again after an upgrade.
502 Bad Gateway on every request	The health probe fails, or the NSG blocks the gateway.	Check the probe path and host, and the port 80 rule for the gateway subnet.
504 Gateway Timeout on bulk uploads or exports	Backend request timeout is too short.	Raise it to 120 seconds or more (Step 1- Configure WAF)
403 from the WAF on a bulk upload	A WAF rule matches the CSV content.	Find the rule in the WAF log and add an exclusion for that path (Step 1)
413 Request Entity Too Large on a bulk upload	WAF request body or file upload limit.	Raise the limit in the WAF policy.
Pages load, however, live updates do not appear.	WebSocket connection to `chatHub` is blocked.	Check that no WAF rule or proxy blocks the WebSocket upgrade.
An API call from a script on the VM itself, through `localhost`, is refused.	UMP-365 refuses its localhost API bypass for requests that contain proxy headers.	Call the API on the VM directly, not through the WAF.

Entra ID shows "The redirect URI ... does not match" and the URI starts with http://

UMP does not receive X-Forwarded-Proto: https

Check that the WAF sends the header. Use ASPNETCORE_FORWARDEDHEADERS_LOG (Step 4 Verify Deployment)

Entra ID shows a redirect URI with the VM name or an internal host name

The WAF rewrites the Host header.

Set override with new host name to No (Step 1- Configure WAF)

Sign-in succeeds but the next page asks to sign in again

Cookies are not marked secure, so the browser drops them.

Same as the first row: UMP-365 must view the request as HTTPS

/authenticate ends in "too many redirects"

The Customer portal does not trust the forwarded headers.

Add ASPNETCORE_FORWARDEDHEADERS_ENABLED (Step 2-Configure the UMP-365 VM). Check again after an upgrade.

502 Bad Gateway on every request

The health probe fails, or the NSG blocks the gateway.

Check the probe path and host, and the port 80 rule for the gateway subnet.

504 Gateway Timeout on bulk uploads or exports

Backend request timeout is too short.

Raise it to 120 seconds or more (Step 1- Configure WAF)

403 from the WAF on a bulk upload

A WAF rule matches the CSV content.

Find the rule in the WAF log and add an exclusion for that path (Step 1)

413 Request Entity Too Large on a bulk upload

WAF request body or file upload limit.

Raise the limit in the WAF policy.

Pages load, however, live updates do not appear.

WebSocket connection to chatHub is blocked.

Check that no WAF rule or proxy blocks the WebSocket upgrade.

An API call from a script on the VM itself, through localhost, is refused.

UMP-365 refuses its localhost API bypass for requests that contain proxy headers.

Call the API on the VM directly, not through the WAF.