How to effectively enable SSO and SLO across multiple websites?

Question

Hello,

We're experiencing an issue with Entra External ID where Single Sign-On (SSO) works across multiple applications, but Single Logout (SLO) does not function as expected.

Scenario:

• We have multiple app registrations, each corresponding to a different website.
• All app registrations use the same user flow configured in Entra External ID.
• SSO is functioning correctly; users can sign in once and access all applications seamlessly.

Problem:

• When a user logs out from one website:
  • The user selects the account that they want to sign out of:
  • The session for that specific application is terminated.
  • The CIAM cookies are deleted.
• Despite this, the user remains logged in on the other websites.
• When attempting to log out from the other websites, users are not prompted to select an account to log out from, and the logout process doesn't seem to acknowledge the active session. It looks like this:
  

Goal:

• We want a true SLO experience where logging out from one application signs the user out of all other applications associated with the same user flow.

Are there additional configurations or steps required to enable SLO across multiple applications in Entra External ID?

Is there a recommended approach or best practices for implementing SLO in this scenario?

Could this be related to how session tokens or cookies are managed across different domains?

Any guidance or suggestions would be greatly appreciated.

Thank you!

Answer 1

Hi @Manuel T

Thank you for posting this in Microsoft Q&A.

I understand you have multiple app registrations, each corresponding to a different website, and they all use the same user flow configured in Entra External ID. Single Sign-On (SSO) is working correctly, but Single Logout (SLO) is not functioning as expected. When a user logs out from one website, they remain logged in on the other websites.

If a single user session is active, Microsoft Entra ID will automatically select that session and the SAML logout will proceed. If multiple user sessions are active, Microsoft Entra ID will enumerate the active sessions for user selection. After user selection, the SAML logout will proceed.

To further troubleshoot the issue, you can try the following:

1.Verify that the logout endpoint is being called correctly when a user initiates logout.

2.Verify that the CIAM cookies are being deleted correctly when a user logs out.

You can Implement front-channel logout, which involves redirecting the user to the logout endpoint when they initiate logout. This will ensure that the user is logged out from all applications.

You can find more information in this document: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#what-is-a-front-channel-logout-url

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.