diff --git a/src/Web/autopilot-monitor-web/components/ProtectedRoute.tsx b/src/Web/autopilot-monitor-web/components/ProtectedRoute.tsx
index 39a6773c..05247165 100644
--- a/src/Web/autopilot-monitor-web/components/ProtectedRoute.tsx
+++ b/src/Web/autopilot-monitor-web/components/ProtectedRoute.tsx
@@ -26,8 +26,14 @@ export function ProtectedRoute({ children, requireGalacticAdmin = false }: Prote
 
   useEffect(() => {
     if (!isLoading && !isAuthenticated && !wasAuthenticated.current) {
-      // Never been authenticated in this session -> redirect to landing
-      router.push("/");
+      // Delay redirect slightly to let MSAL finish its double handleRedirectPromise
+      // settling cycle before deciding the user is truly unauthenticated.
+      const t = setTimeout(() => {
+        if (!wasAuthenticated.current) {
+          router.push("/");
+        }
+      }, 500);
+      return () => clearTimeout(t);
     }
   }, [isAuthenticated, isLoading, router]);
 
diff --git a/src/Web/autopilot-monitor-web/lib/msalConfig.ts b/src/Web/autopilot-monitor-web/lib/msalConfig.ts
index 59a20970..3b2f12b6 100644
--- a/src/Web/autopilot-monitor-web/lib/msalConfig.ts
+++ b/src/Web/autopilot-monitor-web/lib/msalConfig.ts
@@ -16,7 +16,7 @@ export const msalConfig: Configuration = {
     authority: "https://login.microsoftonline.com/organizations", // Multi-tenant
     redirectUri: process.env.NEXT_PUBLIC_ENTRA_REDIRECT_URI || "http://localhost:3000",
     postLogoutRedirectUri: process.env.NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI || "http://localhost:3000",
-    navigateToLoginRequestUrl: true,
+    navigateToLoginRequestUrl: false,
   },
   cache: {
     cacheLocation: "sessionStorage", // Using sessionStorage for better XSS protection