How to do Global single signout?

Question

How to do Global single signout?

Asad Shaikh 0

Hello, I wanted to implement single sign out feature for a my app. But i want something like this: When i logout of my app, I want the user to log out of all other apps as well.

Like i logout of my app 'X' then it should also logout the user from apps registered under same tenant as well as microsoft's app like Microsoft Viva engage, etc.
I am able to log the user out of the apps registered under my tenant, but unable to logout the user from Viva engage app. I also tried using the revokeSignInSessions, but it doesnt logout the user instantly from microsoft's app. This is what i have tried:

I hit this endpoint:
https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/logout?post_logout_redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fauth%2Fentra%2Flogout%2Fcallback

After callback is received, I use revokeSignInSessions which was successful: https://graph.microsoft.com/v1.0/me/revokeSignInSessions

still when I open the Viva Engage on browser, it somehow logs in the user tokens stored in it's cache (i guess)
I want instant logout from every app (apps registered under my tenant as well as microsoft's apps).

Is there a way to implement this? something like a global logout? Is this possible?

0 comments

Answer recommended by moderator

Asad Shaikh 0

Hi @Tom Tran (WICLOUD CORPORATION) ,

Thank you for the detailed clarification.

After reviewing your recommendations, I have finalized the following approach for our logout flow:

RP-initiated logout: I am implementing the standard OIDC RP-initiated logout to ensure that users are signed out through Microsoft Entra ID and all other relying parties (apps) under the same tenant are notified through front-channel logout.
Session revocation: Post logout, I am calling the Microsoft Graph /revokeSignInSessions API to invalidate refresh tokens and revoke any active sessions for the user. This helps ensure that future token refreshes are blocked.
User prompt for browser closure: Since certain applications (like Viva Engage) maintain local session data or caches that are not directly cleared via Entra logout, I will display a user prompt recommending the closure of the browser window to complete the logout process cleanly (because I can't clear Viva Engage's cookies).

We have intentionally not reduced the access token lifetime, for the following reasons:

User Experience: Shorter access token lifetimes would result in frequent re-authentications or background token refresh calls, potentially degrading usability.
Performance Considerations: Reducing token validity increases network traffic and token issuance volume, which could impact performance and cause throttling under high load.
Limited Security Benefit: Even with shorter lifetimes, active tokens remain valid until expiration. Therefore, this approach does not provide true real time revocation, unlike CAE and session revocation.

Thank you!

0 comments

1 additional answer

Your answer

Answer 1

Tom Tran (WICLOUD CORPORATION) 5,945 Microsoft External Staff Moderator

Hi @Asad Shaikh ,

Thanks for the details!

So you’re looking for a global single sign-out so that logging out of your app also signs the user out of other apps in the same tenant and Microsoft apps like Viva Engage. After looking into this topic:

Is there a way to implement this? something like a global logout? Is this possible?

A truly instant global logout across all Microsoft 365 apps is not currently possible. Here’s why:

Microsoft Entra ID can end its own session and revoke refresh tokens, but active access tokens remain valid until they expire (usually ~1 hour) unless the app supports Continuous Access Evaluation (CAE).
Each app controls its own session cookies. Entra can signal logout, but the app must clear its own state.

What you can possibly do:

End the Entra session using RP-Initiated Logout

https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/logout?id_token_hint={id_token}&post_logout_redirect_uri={redirect_uri}

This clears the central session and broadcasts front-channel logout to apps that support it.

Reference: RP-Initiated Logout

Implement Front-Channel Logout in your apps

Each app should have a logout page that clears cookies/local storage when loaded in an iframe.

Reference: Front-Channel Logout

Revoke refresh tokens

Use Microsoft Graph:

POST https://graph.microsoft.com/v1.0/me/revokeSignInSessions

This invalidates refresh tokens but may take a few minutes to propagate. Reference: revokeSignInSessions

Leverage Continuous Access Evaluation (CAE)

CAE-enabled apps (Exchange, SharePoint, Teams) will drop tokens almost instantly after revocation. Viva Engage may not fully support CAE yet. Reference: CAE Overview

Global sign-out is a layered process - central logout, token revocation, and app-specific cleanup. Some apps will sign out immediately, others after token expiry or their next validation.

Hope this helps! If you have any questions, please leave a comment below!

Asad Shaikh 0 Reputation points

2025-10-08T07:11:55.6133333+00:00

Hi @Tom Tran (WICLOUD CORPORATION) ,

Thank you for your detailed response.

I understand that a truly instant global logout across all Microsoft 365 apps is not currently possible because active access tokens remain valid until they expire, and each app manages its own session state.

In our scenario, we do not have the logout endpoints for apps like Viva Engage or other Microsoft applications, so implementing front-channel logout for these apps is not feasible.

Given this limitation, we are exploring an alternative approach: reducing the validity period of the access tokens (for example, to 5 or 10 minutes) and then using the POST https://graph.microsoft.com/v1.0/me/revokeSignInSessions endpoint.
This approach would ensure that access tokens are valid for a much shorter duration, and when the session is revoked, the user would effectively be logged out sooner from apps that rely on these tokens.

Would this approach be recommended or supported by Microsoft? Are there any potential caveats or considerations we should be aware of when reducing the token lifetime in this manner?

Thank you for your guidance.
Tom Tran (WICLOUD CORPORATION) 5,945 Reputation points Microsoft External Staff Moderator

2025-10-08T07:41:30.4133333+00:00
Hi @Asad Shaikh ,

Thank you for the details!

You mentioned that apps like Viva Engage do not expose logout endpoints, so front-channel logout is not feasible. The good news is that CAE and Conditional Access do not require logout endpoints. They work at the token validation layer and enforce re-authentication or token invalidation without relying on app-specific logout pages.

Would this approach be recommended or supported by Microsoft?

Yes, this approach is technically supported. Microsoft Entra ID allows you to configure access token lifetimes using TokenLifetimePolicy. The minimum supported lifetime for access tokens is 10 minutes, and the default is 1 hour.

Reference: Configurable Token Lifetimes

However, Microsoft generally does not recommend aggressively reducing token lifetimes as the primary solution for global sign-out. Instead, the preferred approach is to use Continuous Access Evaluation (CAE) and Conditional Access sign-in frequency for near real-time enforcement.

Reference: Continuous Access Evaluation

Are there any potential caveats or considerations we should be aware of when reducing the token lifetime in this manner?

There are some key points you should keep in mind:

Performance impact: Shorter lifetimes (e.g., 5–10 minutes) increase token refresh frequency, which can lead to higher network traffic, latency, and potential throttling for apps and Microsoft Graph.

User experience: Frequent token refresh may cause more silent authentication calls or even visible re-authentication prompts in some scenarios.

Does not guarantee instant logout: Even with a 10-minute lifetime, active tokens remain valid until they expire. revokeSignInSessions only invalidates refresh tokens, not currently active access tokens.

Licensing and configuration: Requires Microsoft Entra ID P1 and policy configuration per app or tenant.

Propagation delay: Revocation of refresh tokens can take a few minutes to propagate across services.

Alternatively, instead of relying solely on short token lifetimes, you could consider:

Enable CAE for supported apps (Exchange, SharePoint, Teams) for near real-time token invalidation.

Use Conditional Access sign-in frequency to enforce periodic re-authentication without degrading performance. Sign-in Frequency

If you still choose to reduce token lifetime, keep it reasonable (e.g., 30 minutes) to balance security and usability.

In short: Reducing token lifetime is supported but comes with trade-offs and is not the best approach for global sign-out. Combining CAE and Conditional Access provides a more scalable and user-friendly solution even when logout endpoints are not available.

I hope this answers your questions!
Tom Tran (WICLOUD CORPORATION) 5,945 Reputation points Microsoft External Staff Moderator

2025-10-10T02:37:06.8266667+00:00

Hi @Asad Shaikh ,

Just checking in to see how you are doing - I hope you are doing well! If you have any more questions, please leave a comment below. I'll be happy to help!
Tom Tran (WICLOUD CORPORATION) 5,945 Reputation points Microsoft External Staff Moderator

2025-10-10T06:51:51.3866667+00:00

Hi @Asad Shaikh ,

Glad you managed to find an approach to your problem!

If you find my suggestions helpful, please kindly consider marking this answer by following this link instruction so others can find help from your post.

Thank you!