Azure AD is not logging out Identity provider of SAML configured Enterprise application.

Nilotpal Mahadani 0

I have configured an Identity Provider and SAML based Single Sign on with an Enterprise application. I have also configured a Sign out URL there.

When azure AD gets logged out, it is not triggering logout call to the identity provider.

Is there a way to ensure that logout gets called? Or is there any specific config that needs to be done for enabling global logout?

My settings:

I have created an Enterprise application(SAML based Single Sign on) option under Azure Active Directory:

User's image

The green highlighted Logout URL setting is assigned a Logout URL that my 3rd party Identity Provider(a.k.a A service Provider/SP in this context) has. This logout URL is available in the generated SAML metadata by the 3rd party Identity provider/SP as SingleLogoutService.

User's image

Marilee Turscak-MSFT 33,801 Reputation points Microsoft Employee

2023-01-25T02:07:48.82+00:00

Hi @Nilotpal Mahadani Which logout URL are you using and what do you have configured in the app registration and in the app itself?
Nilotpal Mahadani 0 Reputation points

2023-01-27T12:21:41.4366667+00:00

Hello, I have updated the question with additional details. I needed to use SSO where Azure AD would be an IdP and my 3rd party identity provider as SP. That is why I used Enterprise applications option.

Marilee Turscak-MSFT 33,801 Microsoft Employee

It sounds like the session is not being removed. Is the SAML logout request being sent to the other IdP?

<samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="12345" Version="2.0" IssueInstant="2021-01-22T00:00:00Z" Destination="https://tenant-name.b2clogin.com/tenant-name.onmicrosoft.com/policy-name/Samlp/logout">
  <saml:Issuer>http://your-app.com/app1</saml:Issuer>
</samlp:LogoutRequest>