Entra External ID Single Sign Out

Question

Entra External ID Single Sign Out

Michal Durista 71

Hello,

is it even possible to use front-channel log out for Entra External ID? Multiple people tried this but without success. Here is the problem:

We have 2 SPA apps (react) that use msal library
When I log into app A, I am automatically logged into app B (correct)
When I log out from app A, I want to be logged out from app B
I configured front-channel logout urls in both apps (https://localhosts with their respective ports for now)
From what I understand, now all apps that have the url registered should run hidden iframe with the url.
Doesn't even matter what is in the /signout-oidc endpoint as it is never hit in app B when I am logging out from app A (though I can see a request to app A's /signout-oidc endpoint).

What am I missing? Any other settings I missed?

Thanks

Michal

EDIT:

The endpoint is hit (my mistake) in Firefox, however, clearing localStorage/sessionStorage/caches.. still does not work, I assume there is a problem with third-arty storage? My question still stands however, is it even possible in SPA using front-channel log out?

VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-02-18T08:13:06.2766667+00:00
Hello Michal Durista,

Yes, front‑channel logout is supported in Entra External ID, but it is not reliable for SPA-to-SPA single sign‑out in modern browsers. What you’re seeing is expected behavior.

Why this happens:

Front‑channel logout works by loading each app’s logout URL in a hidden iframe.

In SPAs, auth state lives in localStorage/sessionStorage.

When your app is loaded inside a third‑party iframe, modern browsers block or restrict storage access (Chrome/Safari/Edge).

So even though /signout-oidc is hit, the SPA often cannot fully clear MSAL state, and the other app stays logged in.

Firefox is more permissive, which is why it “works” there but not elsewhere.

Important clarification: Front‑channel logout only notifies apps — it does not guarantee clearing SPA auth state across different origins (different ports = different origins), especially under current browser privacy rules.

What actually works for SPAs:

Implement application‑level logout coordination, for example:

Broadcast logout using BroadcastChannel / localStorage signal

Or a shared backend / central logout page

When app B receives the signal, it explicitly calls msal.logoutRedirect() (or clears MSAL cache and forces re‑auth).

Your answer

VEMULA SRISAI 13,900 Reputation points Microsoft External Staff Moderator

2026-02-18T08:13:06.2766667+00:00

Hello Michal Durista,

Yes, front‑channel logout is supported in Entra External ID, but it is not reliable for SPA-to-SPA single sign‑out in modern browsers. What you’re seeing is expected behavior.

Why this happens:

Front‑channel logout works by loading each app’s logout URL in a hidden iframe.

In SPAs, auth state lives in localStorage/sessionStorage.

When your app is loaded inside a third‑party iframe, modern browsers block or restrict storage access (Chrome/Safari/Edge).

So even though /signout-oidc is hit, the SPA often cannot fully clear MSAL state, and the other app stays logged in.

Firefox is more permissive, which is why it “works” there but not elsewhere.

Important clarification: Front‑channel logout only notifies apps — it does not guarantee clearing SPA auth state across different origins (different ports = different origins), especially under current browser privacy rules.

What actually works for SPAs:

Implement application‑level logout coordination, for example:

Broadcast logout using BroadcastChannel / localStorage signal

Or a shared backend / central logout page

When app B receives the signal, it explicitly calls msal.logoutRedirect() (or clears MSAL cache and forces re‑auth).