Azure Entra External Id can't actually sigh out when clicking "Signout" on API side

Question

Azure Entra External Id can't actually sigh out when clicking "Signout" on API side

Mok Joe 0

Hi,

we are new to setup Azure Entra External Id as SSO ( SAML ), it is okay to sign in from other apps.

however we find the login session didn't really terminate when we do a signout action on apps.
user can login the apps without entering a password , string running into the apps after entering mail address.

since the "Azure Entra External Id" service log only sign in, there seems no way to monitor the signout action from Azure.

will be great if i can have a hand how to start trouble shoot of this problem

Shubham Sharma 9,275 Reputation points Microsoft External Staff Moderator

2026-01-28T08:30:56.5+00:00
Hello Mok Joe

Thank you for reaching out to Microsoft Q&A.

Below are the resolution steps: -

Why users appear “not actually signed out”

SAML logout ≠ Identity session termination

When your app calls Sign out, it usually only clears the application session, not the Microsoft Entra External ID browser session.

Microsoft documents that:

Microsoft Entra ID supports SAML Single Logout only if a proper SAML LogoutRequest is initiated and supported by both sides. Many applications do not implement SAML SLO, so the Entra session remains active.

For your reference: https://learn.microsoft.com/en-us/entra/identity-platform/single-sign-out-saml-protocol

Because the Entra session cookie still exists:

User re-enters email

Entra immediately issues a new assertion

No password prompt

This is by design

2.Entra External ID does not log sign-out events

“Azure Entra External ID service log only sign in”

Microsoft confirms:

Sign‑out events are not logged

AuditLogs / SignInLogs only record authentication

Logout is a front‑channel browser event only

This means you cannot monitor logout from Entra logs

3.SAML Single Logout (SLO) works only if ALL conditions are met

Microsoft’s SAML SLO support requires:

Requirement & Status

App sends a proper Logout Request -Often

Logout URL registered in Entra - Required

HTTP‑Redirect binding -Required

App handles Logout Request -Often

If the app doesn’t support SAML SLO, Entra can’t terminate the session.

For your reference: https://learn.microsoft.com/en-us/entra/identity-platform/single-sign-out-saml-protocol

Why External ID behavior is more noticeable

Microsoft Entra External ID (CIAM):

Optimized for customer sign‑in experience

Designed for low‑friction reauthentication

Browser session persistence is intentional

Doc: https://learn.microsoft.com/en-us/entra/external-id/customers/reference-service-limits

What will actually sign users out (supported solutions)

Option 1 — Force Entra sign‑out (recommended)

Redirect users to Entra logout endpoint:

https://login.microsoftonline.com/{tenant-id}/saml2

This clears the Entra session cookie

Works even without SAML SLO

Microsoft docs: https://learn.microsoft.com/en-us/entra/identity-platform/single-sign-out-saml-protocol

Apps must explicitly redirect to Entra logout endpoint

Clearing local sessions is not enoughOption 2 — Use WS‑Federation logout (if app doesn’t support SAML SLO)

For apps that cannot send LogoutRequest:

https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
Shubham Sharma 9,275 Reputation points Microsoft External Staff Moderator

2026-01-29T08:30:47.1366667+00:00

Hello Mok Joe

Following up to check if the resolution provided was helpful. Please let us know if you need any further assistance.

Your answer

Shubham Sharma 9,275 Reputation points Microsoft External Staff Moderator

2026-01-29T08:30:47.1366667+00:00

Hello Mok Joe

Following up to check if the resolution provided was helpful. Please let us know if you need any further assistance.

Share via

Azure Entra External Id can't actually sigh out when clicking "Signout" on API side

Your answer