Why does Azure AD require to enter user credentials for sign-in after sign-out?

Question

Hello!
I want to understand SSO concept.

1. I am signed-in in portal.azure.com
2. I open Loginpage of my app and press button "Login by Microsoft"
3. I am signed-in in my app automatically (AAD doesn't require to enter my credentials)
4. I do log out from my app.
5. I open Loginpage of my app and press button "Login by Microsoft" again.
6. AAD requires to enter my credentials

Why AAD requires my credentials after logout?
What is changed before second login attempt comparing before first login attempt?

I work on Asp.net Framework and use OWIN and OpenId Connect.

Answer 1

Hi @Дмитрий Семин · Thank you for reaching out.

If you organization has configured Azure Active Directory Seamless Single Sign-On or If the devices are Azure AD Registered/Azure AD Joined/Azure AD Hybrid Joined, users automatically sign into web application under currently logged in user's context using PRT (Primary Refresh Token). However, when user explicitly signs out of the application, the PRT cookie and Session cookies are explicitly marked as expired and are invalidated. Which is why at the next sign-in user is required to enter his/her credentials.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.