When you try to make changes to the Incoming SMS settings or set a new lookup configuration in your Salesforce and get this error "Unauthorized return URL". Here is a screenshot of the error:



There is a critical update named 'Remove Instance Names From URLs for Visualforce, Community Builder, Site.com Studio, and Content Files' which when enabled causes the problem.




Workaround -:

1)Deactivate the above update.

2)Create configurations.

3)Activate the update again.