[Bug] Getting "Broker resonse returned error: The redirect URI doesn't match the uri generated with caller package name and signature" but only on some devices

[MihaMarkic]

Library version used

4.83.+ at least

.NET version

.net 9.0-android

Scenario

PublicClient - mobile app

Is this a new or an existing app?

The app is in production, I haven't upgraded MSAL, but started seeing this issue

Issue description and reproduction steps

Describe the bug

My android app is live and I'm getting "Broker resonse returned error: The redirect URI doesn't match the uri generated with caller package name and signature" broker response but only on some devices. Majority seems working fine.
The exception occurs upon call to IPublicClientApplication.AcquireTokenSilent. I build the IPublicClientApplication using PublicClientApplicationBuilder and passing secrets through its methods.

To Reproduce

Call IPublicClientApplication.AcquireTokenSilent method.

Expected behavior

URI should match.

Actual Behavior

Getting an exception "Broker resonse returned error: The redirect URI doesn't match the uri generated with caller package name and signature"

Additional context

It happens only on some devices, unclear what is related to.
The question is, is there a way to get actual redirect URI that app compares?

Relevant code snippets

var builder = PublicClientApplicationBuilder
                .Create("ClientID")
                .WithTenantId("TenantId")
                .WithRedirectUri("MSBrokerRedirectUri")
                .WithBroker();
var pca = builder.Build();
var accounts = await pca.GetAccountsAsync();
try
{
    IAccount firstAccount = accounts.FirstOrDefault();
    var authResult = await pca.AcquireTokenSilent(Scopes, firstAccount).ExecuteAsync();
    // exception here ^^

Expected behavior

Redirect URI is correct.

Identity provider

Microsoft Entra External ID

Regression

No response

Solution and workarounds

None

[MihaMarkic]

It seems like if I call AcquireTokenInteractive after this exception (MsalServiceException), then user is able to authenticate. So far I was calling it only on MsalUiRequiredException.
Is this still a bug, perhaps wrong exception type or something else?

[pjarre-ue]

I am getting a similar issue but we are authenticating to Microsoft Entra ID using brokered auth as well but we are on .net 10.0-android and using library version 4.73.0. On devices that have the issue I have noticed that Microsoft Authenticator (which is acting as the broker) has the following error in the logs:

2026-06-11 03:19:50,844 ERROR/ROOT:
[callerInfo:getSha512SignatureForPackage]
[2026-06-11 03:19:50 ... thread_id: 105, correlation_id: ...]

Calling App's package does not exist in
PackageManager. - Android 36

android.content.pm.PackageManager$NameNotFoundException:

I have been able to fix by reinstalling the app attempting authentication (internally deployed using Managed Google Play Store/Intune), but I will try your workaround @MihaMarkic. I have also noticed that this issue only happens on Android 16 devices, older Android versions don't seem to have an issue.

[MihaMarkic]

I have also noticed that this issue only happens on Android 16 devices, older Android versions don't seem to have an issue.

That is possible. I could only test it on an Samsung with Android 16, even that was challenging because it was at customer's.