hi,
The NullPointerException on the OAuth callback in the E-mail Module with Templates is a known issue caused by how that module manages the OAuth flow — and it only sometimes fails in Mendix Cloud because of session state issues during the redirect.
/callback_et/azure), but the module’s callback handler expects data in session or context that is no longer available.NullPointerException in the handler (OauthCallBackRequestHandler.processRequest). This behavior isn’t a bug in your configuration — it’s because the module’s callback flow isn’t designed to handle cross-site redirect state loss in a cloud cluster.
You can often see a similar failure when the session cookie is not sent during the redirect, because Mendix’s default SameSite=Strict setting blocks it. Other users have reported exactly this issue.
When configuring Microsoft Azure AD OAuth for the module, you must:
https://<yourappdomain>/<OAuthCallbackPath>/azure
OAuthCallbackPath from module constants) The documentation does not explicitly cover cloud session behavior — that’s left to the community, and others have run into the same problem.
In your Azure app registration, the redirect URI must exactly match:
https://<yourapp>.mendixcloud.com/callback_et/azure
including trailing path. A mismatch will not even reach your callback, but you do reach the callback in this case — so this part is correct.
Many OAuth callback problems (including in this module) are caused by Mendix session cookies not being sent across the Azure redirect.
By default Mendix marks cookies as SameSite=Strict.
To allow the OAuth callback to receive the session properly:
In Runtime Customization add:
com.mendix.core.SameSiteCookies=Lax
This allows the session cookie to be included during the cross-site redirect from Azure, which prevents the NullPointerException in the callback handler.
This issue is not a misconfiguration of Azure credentials — it’s the session state loss during OAuth redirect that triggers the exception.
The E-mail Templates module was moved to community support; it’s not maintained by Mendix anymore. If you rely on OAuth flows in production, the recommended supported module is Email Connector.
SameSite=Strict. SameSiteCookies=Lax via runtime customization.