diff --git a/src/containerapp/HISTORY.rst b/src/containerapp/HISTORY.rst
index 99aba7e9a08..0cc57231005 100644
--- a/src/containerapp/HISTORY.rst
+++ b/src/containerapp/HISTORY.rst
@@ -8,6 +8,7 @@ Release History
 * Added parameter --environment to 'az containerapp list'
 * Added 'az containerapp revision label swap' to swap traffic labels
 * BREAKING CHANGE: 'az containerapp revision list' now shows only active revisions by default, added flag --all to show all revisions
+* Fixed bug with 'az containerapp auth update' when using --unauthenticated-client-action
 
 
 0.3.5
diff --git a/src/containerapp/azext_containerapp/_constants.py b/src/containerapp/azext_containerapp/_constants.py
index 1ba84998feb..0b14b16d8f4 100644
--- a/src/containerapp/azext_containerapp/_constants.py
+++ b/src/containerapp/azext_containerapp/_constants.py
@@ -21,6 +21,6 @@
 MSA_SECRET_SETTING_NAME = "msa-provider-authentication-secret"
 TWITTER_SECRET_SETTING_NAME = "twitter-provider-authentication-secret"
 APPLE_SECRET_SETTING_NAME = "apple-provider-authentication-secret"
-UNAUTHENTICATED_CLIENT_ACTION = ['RedirectToLoginPage', 'AllowAnonymous', 'RejectWith401', 'RejectWith404']
+UNAUTHENTICATED_CLIENT_ACTION = ['RedirectToLoginPage', 'AllowAnonymous', 'Return401', 'Return403']
 FORWARD_PROXY_CONVENTION = ['NoProxy', 'Standard', 'Custom']
 CHECK_CERTIFICATE_NAME_AVAILABILITY_TYPE = "Microsoft.App/managedEnvironments/certificates"