User navigates to https://developer-portal.gcfund.org/ and lands on the Sign in page.
User clicks the "Microsoft Entra ID" button (the SSO widget shown on the sign-in form).
Browser redirects to the Microsoft login page; user authenticates with their Entra ID credentials (or is already signed in and passes through silently).
Browser redirects back to the Developer Portal — the token itself appears to be issued successfully at this stage (we can see it being returned from the /token and /openid-configuration calls in the browser dev tools).
However, right after that, the portal makes a POST request to https://apim-gcf-koreacentral.data.azure-api.net/users?api-version=2022-04-01-preview — this fails immediately with 401 Unauthorized, and the response includes WWW-Authenticate: AAD realm="" error="scheme_not_supported".
Because the response body is empty, the portal's frontend throws SyntaxError: Unexpected end of JSON input while trying to parse it, and the user is left on the sign-in page with this error banner instead of being signed in.
So the failure point seems to be after the Entra ID token is obtained, at the point where the Developer Portal tries to use that token to call APIM's /users endpoint. We've also confirmed that the client secret on our Entra App Registration is not close to expiry, so we don't believe this is a simple credential expiration issue.
User navigates to https://developer-portal.gcfund.org/ and lands on the Sign in page.
User clicks the "Microsoft Entra ID" button (the SSO widget shown on the sign-in form).
Browser redirects to the Microsoft login page; user authenticates with their Entra ID credentials (or is already signed in and passes through silently).
Browser redirects back to the Developer Portal — the token itself appears to be issued successfully at this stage (we can see it being returned from the /token and /openid-configuration calls in the browser dev tools).
However, right after that, the portal makes a POST request to https://apim-gcf-koreacentral.data.azure-api.net/users?api-version=2022-04-01-preview — this fails immediately with 401 Unauthorized, and the response includes WWW-Authenticate: AAD realm="" error="scheme_not_supported".
Because the response body is empty, the portal's frontend throws SyntaxError: Unexpected end of JSON input while trying to parse it, and the user is left on the sign-in page with this error banner instead of being signed in.
So the failure point seems to be after the Entra ID token is obtained, at the point where the Developer Portal tries to use that token to call APIM's /users endpoint. We've also confirmed that the client secret on our Entra App Registration is not close to expiry, so we don't believe this is a simple credential expiration issue.