I'm trying to setup Horizon 10.0.1 with Sitecore 10.0.1 on Azure with custom domain (no Content Hub). I followed all the steps from the Azure PaaS Installation guide.

I use the following host names:


I have valid certificate for *.MYHOSTNAME.eu.

In Sitecore Identity in Config/production/Sitecore.IdentityServer.AuthoringHost.xml file I have


On CM in /App_Config/Modules/Horizon/Sitecore.Horizon.Integration.config I have:

<setting name="Horizon.ClientHost" value="https://test-horizon.MYHOSTNAME.eu" />

and I have

<setting name="Sitecore.Services.SecurityPolicy" value="Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy, Sitecore.Services.Infrastructure" patch:source="Sitecore.Horizon.Integration.SSC.config"/>

In horizon in /sitecore/Sitecore.Horizon.Authoring.Plugin/Config/Host.xml I have:


In horizon in /sitecore/Sitecore.Horizon.Authoring.Plugin/Config/OpenIdConnect.xml:


in /sitecore/Sitecore.Horizon.ContentHub.Dam.Plugin/Config/Plugin.xml:


in /sitecore/Sitecore.Zenith/Config/Sitecore.Zenith.Proxy.xml:


When I open horizon url I'm redirected to identity server. I login as Admin, and I'm redirected back to horizon url /composer/pages/editor but the screen keeps refreshing and there is an error saying

The page did not load properly. Try refreshing the page. If the error reoccurs, contact your system administrator.

horizon sitecore - The page did not load properly

With developer tools I can see that there is a call to https://test-horizon.MYHOSTNAME.eu/horizon/api and the response is

    "data": {
        "configuration": {
            "primaryPlatformUrl": "https://test-cm.MYHOSTNAME.eu",
            "additionalPlatformUrls": [],
            "hostVerificationToken": "",
            "contentRootItemId": "00000000-0000-0000-0000-000000000000",
            "__typename": "Configuration"
    "errors": [{
        "message": "{\"Message\":\"Authorization has been denied for this request.\"}",
        "extensions": {
            "code": "NOT_AUTHORIZED"

In Application Insights I can see entries from CM server saying for all /sitecore/api/ssc/horizon/* request returning 401 response, e.g. /sitecore/api/ssc/horizon/configuration/?sc_horizon=api or /sitecore/api/ssc/horizon/sites/-/getsites?sc_horizon=api&IncludeSystemSites=False

enter image description here

But when I open it via url directly in the browser https://test-cm.MYHOSTNAME.eu/sitecore/api/ssc/horizon/sites/-/getsites?sc_horizon=api&IncludeSystemSites=False I can see valid json response.

It looks like identity server configuration is ok cause it allows to login from Horizon. And it looks like horizon config is ok as well - it sends requests to CM and CM receives them. But for some reason CM returns 401 for requests sent from Horizon.

I saw the other question related to Horizon reloading all the time ( SItecore 9.3 - Horizon - Page keeps on reloading issue ) but I do have Sitecore Identity Server enabled, so it's not the reason of my issues.

Any idea if I missed something?


I found an exception in AI coming from CM server:

Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware - Authentication failed   

Exception: Microsoft.IdentityModel.Tokens.SecurityTokenInvalidAudienceException
Message: IDX10214: Audience validation failed. Audiences: '[PII is hidden]'. Did not match: validationParameters.ValidAudience: '[PII is hidden]' or validationParameters.ValidAudiences: '[PII is hidden]'.
Source: Microsoft.IdentityModel.Tokens
   at Microsoft.IdentityModel.Tokens.Validators.ValidateAudience(IEnumerable`1 audiences, SecurityToken securityToken, TokenValidationParameters validationParameters) in C:\agent2\_work\56\s\src\Microsoft.IdentityModel.Tokens\Validators.cs:line 108
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateTokenPayload(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters) in C:\agent2\_work\56\s\src\System.IdentityModel.Tokens.Jwt\JwtSecurityTokenHandler.cs:line 737
   at Microsoft.Owin.Security.Jwt.JwtFormat.Unprotect(String protectedText)
   at Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationHandler.d__3.MoveNext()

I'm not sure if that's relevant. Adding here just in case.

  • Are there any errors in the Identity Server app logs? – Alessandro Faniuolo Jan 28 at 15:16
  • @AlessandroFaniuolo No errors. Only [INF] entries. But I found an exception in Application Insights coming from CM server. Potentially related. So I updated the question – Marek Musielak Jan 28 at 15:35
  • The ADFS audience validation failure seems to be caused by a domain mismatch. Do you see any internal Azure hostnames (<your_app_service>.azurewebsites.net) in the Identity Server logs records? – Alessandro Faniuolo Jan 28 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.