LOGOUT user from Entra ID

Hello Janez**,**

Good day! Thank you for reaching out to Microsoft community.

As per the user account which you used to open/ create this thread, it indicates that your email hosting provider is not Microsoft 365 exchange online but the DNS record from your domain shows that the MX is pointed to Amazon.

However, that does not mean you cannot use the Entra ID (formally known as Azure active directory).

Of course, with additional license you, including your organization can use Microsoft Entra ID.

To better understand your problem, I need you to give me some additional information so that we can get on the same page and resolve the issue by working together.

Please correct me if I am wrong and I need your help on sending all the answers along with the data only via Private Messages - Microsoft Community.

• May I know your affected account type and subscription?
• the affected user ID.
• Are you a global administrator user or an End user?
• Do you have access to Microsoft 365 Admin Center?
• Please share more details and data in the private message platform.

Note: to access private message platform, please click on this link: Private Messages - Microsoft Community.

Meanwhile you may check these initial steps:

To log out a user from Entra ID in a web application with SSO single-page sign-in, you need to ensure that the user's session is properly terminated both in your application and with the Entra ID:

• When your web app redirects the user to the logout endpoint, this endpoint clears the user's session from the browser. This ensures that the user is logged out from Entra ID as well.
  • For your reference: Write a web app that signs in/out users - Microsoft identity platform | Microsoft Learn.
• If you are using SAML, you can enable single logout by configuring the logout URL in the Microsoft Entra admin center.
  • Go to the configured application's page, click Single sign-on in the left menu, and then copy the Logout URL. Enter this URL in the Sign-out URL field of your SAML configuration.
  • For your reference: https://help.zoho.com/portal/en/kb/accounts/manage-your-organization/saml/articles/access-zoho-via-entra-id#Required\_items\_from\_Microsoft\_Entra\_ID
• You can choose between a pop-up or redirect experience for signing out. Use a pop-up window if you don't want users to move away from your main application page during authentication. Use a redirect if users have browser constraints or policies where pop-up windows are disabled.
  • For your reference: Single-page app sign-in & sign-out - Microsoft identity platform | Microsoft Learn.
• This feature allows an application to notify other applications that the user has logged out. When the user logs out of one application, the application sends a logout request to all other applications that the user has logged into. To implement front-channel logout, you need to register the logout endpoints for all your applications with Azure AD Application registration.
  • For your reference: Entra Id - OpenID Single Sign Out - Microsoft Q&A.

If you want to learn more about sign-out, read the protocol documentation that's available from OpenID Connect.

I hope this helps. Please follow these steps and let me know the outcome. If the issue persists after completing the above, feel free to reach out, and we can further investigate the problem together.

Thanks for choosing the MS community.

Looking forward to your response and have a great day ahead!!

Sincerely

S M Nazmun Nur | Microsoft Community Moderator

Hello Janez**,**

Thank you for the clarification and for confirming that you're working with OAuth2 and OpenID sign-out for your multi-tenant app.

I'm glad to hear that OpenID sign-out seems to fit your needs. ^_^

Just to help ensure you're on the right track, here are a few things to keep in mind when implementing OpenID sign-out with OAuth2:

• Ensure that you’re directing users to the OpenID Connect logout endpoint to properly end their session across tenants.
• You can also implement front-channel logout to notify other applications when a user logs out from one application.

For more detailed instructions, feel free to refer to the official documentation here: OpenID Connect (OIDC) on the Microsoft identity platform - Microsoft identity platform | Microsoft Learn.

I hope this helps. Let me know if you have any further questions or concerns.

If you think that I have provided the necessary information related to this post and it's Helpful, you can also vote for this thread. In order to make this thread a top content and help any other community users who might be facing a similar scenario to easily find this thread/post.

Thanks for choosing the MS community.

Looking forward to your response and have a great day ahead!!

Sincerely

S M Nazmun Nur | Microsoft Community Moderator

Hey, thanks for answering.

It's not about one affected user or domain, it's a multi tenant app and we don't know how to implement logout. It's not about subscription either.

We don't use SAML, we use oauth2 to obtain the access token.

I opted for OpenID sign out, seems to be what we need.

thanks!