Thanks for raising this question in the Power Platform Community forum.
Your analysis is completely correct and your Azure Front Door configuration itself has no issues — the ExternalAuthenticationFailed error and the wrong redirect_uri are caused by a fundamental requirement of Power Pages that you cannot bypass. Here is a clear answer to each of your four questions followed by the recommended architecture.
Answer to Question 1 : Yes, the custom domain MUST be configured in Power Pages
Power Pages generates all authentication URLs — including the redirect_uri sent to Microsoft Entra ID — based on the hostname that Power Pages itself recognizes as valid for the portal. If the custom domain is only configured in Azure Front Door but not in Power Pages, the portal will always use the default *.powerappsportals.com domain in its OAuth redirect, regardless of what domain the user accessed. This is why your login flow redirects back to the default domain. There is no workaround for this — Power Pages must be told about the custom domain directly.
Answer to Question 2 : Yes, Power Pages requires its own certificate, but it can be a free auto-managed one
When you add a custom domain in Power Platform Admin Center → Power Pages site → Connect custom domain, Power Pages does require an SSL certificate bound to that domain. However, this is separate and independent from the Azure Front Door managed TLS certificate — you will effectively have two certificates for the same domain. The good news is that Power Pages will attempt to automatically generate and bind a free SSL certificate for the custom domain during the "Connect custom domain" wizard. In many cases, no manual upload is needed — the auto-bind succeeds without you uploading a PFX. If it fails, you have options (see below).
Answer to Question 3 : No direct relay of AFD certificate to Power Pages, but automation is possible
There is no supported architecture where Power Pages uses the Azure Front Door managed TLS certificate directly. They are separate TLS termination points. However, you can achieve full certificate automation using one of these approaches:
- Azure Key Vault + automated renewal — store a certificate in Azure Key Vault with auto-renewal policy, reference it from both Azure Front Door and Power Pages custom domain
- Let's Encrypt automation — use a CI/CD pipeline (GitHub Actions or Azure DevOps) to renew Let's Encrypt certificates and automatically upload them to Power Pages via Power Platform CLI
Answer to Question 4 : Configuring the domain in Power Pages IS required
There is no configuration that resolves ExternalAuthenticationFailed without adding the custom domain to Power Pages. The fix must include Power Pages recognizing the custom hostname.
Complete Working Architecture
Follow these exact steps in this order:
Step 1 — Temporarily point CNAME directly to Power Pages (required for validation)
During the Power Pages custom domain setup, the CNAME must point directly to the Power Pages default domain (not to Azure Front Door) because Power Pages validates ownership by checking DNS:
text
subdomain.yourdomain.com → CNAME → yourportal.powerappsportals.com
Step 2 — Add and validate the custom domain in Power Pages
Go to Power Platform Admin Center → your Power Pages site → Custom domains → Add domain:
- Enter your custom subdomain
- Power Pages will verify the CNAME record
- Allow Power Pages to auto-generate and bind the SSL certificate (wait 5–10 minutes)
- If auto-bind fails, upload a PFX certificate for the domain manually
Step 3 — Switch CNAME to Azure Front Door endpoint (after Power Pages validation)
Once the custom domain is successfully registered in Power Pages, update your DNS CNAME to point to Front Door:
text
subdomain.yourdomain.com → CNAME → yourprofile.azurefd.net
Step 4 — Update App Registration redirect URIs
In Microsoft Entra ID → App Registrations → your app → Authentication → Redirect URIs, add:
Step 5 — Verify Power Pages site settings
In Power Pages Management → Site Settings, verify:
Authentication/OpenIdConnect/Primary/RedirectUri = https://subdomain.yourdomain.com/signin-oidc
After completing all steps, your flow will work as expected:
User → subdomain.yourdomain.com → Azure Front Door (TLS termination + WAF) →
Power Pages (origin, recognizes custom domain) → Entra ID login →
redirect_uri = https://subdomain.yourdomain.com ✓
If it helps kindly accept the answer.
Best Regards,
Jerald Felix
