Swift user signed out of application (using OpenID, not MSAL) but redirect does not occur

Question

Swift user signed out of application (using OpenID, not MSAL) but redirect does not occur

Chad Rutherford 0

When signing a user out in my application, the logout request succeeds, but the user is left on a web page that reads, "You signed out of your account It's a good idea to close all browser windows" After researching this several sources, indicate that this means redirect to post_logout_redirect_uri has failed due to incorrect match. The issue is, I have the post_logout_redirect_uri exactly matching the redirect uri in my App registration and the scheme and redirect uri match.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-14T17:54:58.17+00:00
Hello Chad Rutherford,

Your understanding is close, but that page doesn’t always mean the URI is incorrect.

Sign-out can succeed and still not redirect if the logout request isn’t fully validated. Matching the sign-in redirect URI alone isn’t sufficient.

Check the following:

Add the post_logout_redirect_uri under App Registration → Authentication

Ensure it matches exactly (trailing slash, casing, scheme)

Include id_token_hint in the logout request

Make sure the URI is URL-encoded

If using /common, try a tenant-specific endpoint

In this case, sign-out is successful. The redirect is simply not being applied.
Chad Rutherford 0 Reputation points

2026-04-14T20:29:26.4666667+00:00

Ok when passing id_token_hint, I get "You're signed out here but you need to manually sign out from other apps" briefly, and then it redirects to "You signed out of your account" screen again without the redirect. I have tried URL Encoded post_logout_redirect_uri and id_token_hint and logout_hint as I saw in a MS post online. Nothing is redirecting.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-14T20:44:20.4833333+00:00

Hello Chad Rutherford,

Since id_token_hint, encoding, and logout_hint are already in place, the logout request is completing as expected.

The behavior you’re seeing indicates the post_logout_redirect_uri is still not being accepted. In this scenario, the most likely cause is that the URI is not registered under the correct platform in the app registration.

For OpenID-based flows using a browser (like your Swift app), the redirect URI needs to be configured under the Web platform. If it’s only listed under SPA, the logout redirect won’t be honored.

Once it’s added under the correct platform, the redirect should work.
Chad Rutherford 0 Reputation points

2026-04-14T21:04:01.7733333+00:00

The redirect URI is added under iOS/macOS like was instructed in the documentation for authenticating using an iOS application.
Chad Rutherford 0 Reputation points

2026-04-14T21:06:07.6533333+00:00

And it's odd that the login authentication flow redirects using the redirect uri but the logout authentication flow refuses to accept it
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-14T21:40:25.7066667+00:00

Hello Chad Rutherford,

What you’re seeing can happen because sign-in and sign-out don’t treat redirect URIs the same way. A URI that works for login can still be ignored during logout.

Since you’ve already validated the parameters and the logout is completing, this points to how the post_logout_redirect_uri is being evaluated in the logout flow rather than an issue with your configuration.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-15T23:20:36.14+00:00

Hello Chad Rutherford,

Any update on this? Please confirm if you still have further queries.
Chad Rutherford 0 Reputation points

2026-04-16T17:58:08.65+00:00

I do have further queries. I have read that Microsoft themselves use ASWebAuthenticationSession in their MSAL library. And I know that using MSAL logout does not keep the user on the screen mentioned above. So since the redirect is not happening, I guess I am looking for guidance on how to get this to work.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-16T18:06:23.86+00:00
Hello Chad Rutherford,

You’re right that MSAL uses ASWebAuthenticationSession, but the difference is in how logout is handled.

MSAL doesn’t rely on post_logout_redirect_uri to return to the app. It clears the session and closes the browser, so control goes back to the app without depending on a redirect.

With a direct OpenID implementation, the redirect is handled by the service, and for iOS custom scheme URIs it isn’t always honored. That’s why you’re seeing the signed-out page even though logout is successful.

So nothing is broken in your request.

To handle this:

Don’t rely on the redirect for native apps

Treat logout as complete once the request finishes

Dismiss ASWebAuthenticationSession and navigate the user in-app

If you want the same behavior as MSAL, it needs to be handled on the client side rather than depending on post_logout_redirect_uri.

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-14T17:54:58.17+00:00

Hello Chad Rutherford,

Your understanding is close, but that page doesn’t always mean the URI is incorrect.

Sign-out can succeed and still not redirect if the logout request isn’t fully validated. Matching the sign-in redirect URI alone isn’t sufficient.

Check the following:

Add the post_logout_redirect_uri under App Registration → Authentication

Ensure it matches exactly (trailing slash, casing, scheme)

Include id_token_hint in the logout request

Make sure the URI is URL-encoded

If using /common, try a tenant-specific endpoint

In this case, sign-out is successful. The redirect is simply not being applied.
Chad Rutherford 0 Reputation points

2026-04-14T20:29:26.4666667+00:00

Ok when passing id_token_hint, I get "You're signed out here but you need to manually sign out from other apps" briefly, and then it redirects to "You signed out of your account" screen again without the redirect. I have tried URL Encoded post_logout_redirect_uri and id_token_hint and logout_hint as I saw in a MS post online. Nothing is redirecting.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-14T20:44:20.4833333+00:00

Hello Chad Rutherford,

Since id_token_hint, encoding, and logout_hint are already in place, the logout request is completing as expected.

The behavior you’re seeing indicates the post_logout_redirect_uri is still not being accepted. In this scenario, the most likely cause is that the URI is not registered under the correct platform in the app registration.

For OpenID-based flows using a browser (like your Swift app), the redirect URI needs to be configured under the Web platform. If it’s only listed under SPA, the logout redirect won’t be honored.

Once it’s added under the correct platform, the redirect should work.
Chad Rutherford 0 Reputation points

2026-04-14T21:04:01.7733333+00:00

The redirect URI is added under iOS/macOS like was instructed in the documentation for authenticating using an iOS application.
Chad Rutherford 0 Reputation points

2026-04-14T21:06:07.6533333+00:00

And it's odd that the login authentication flow redirects using the redirect uri but the logout authentication flow refuses to accept it
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-14T21:40:25.7066667+00:00

Hello Chad Rutherford,

What you’re seeing can happen because sign-in and sign-out don’t treat redirect URIs the same way. A URI that works for login can still be ignored during logout.

Since you’ve already validated the parameters and the logout is completing, this points to how the post_logout_redirect_uri is being evaluated in the logout flow rather than an issue with your configuration.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-15T23:20:36.14+00:00

Hello Chad Rutherford,

Any update on this? Please confirm if you still have further queries.
Chad Rutherford 0 Reputation points

2026-04-16T17:58:08.65+00:00

I do have further queries. I have read that Microsoft themselves use ASWebAuthenticationSession in their MSAL library. And I know that using MSAL logout does not keep the user on the screen mentioned above. So since the redirect is not happening, I guess I am looking for guidance on how to get this to work.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-16T18:06:23.86+00:00

Hello Chad Rutherford,

You’re right that MSAL uses ASWebAuthenticationSession, but the difference is in how logout is handled.

MSAL doesn’t rely on post_logout_redirect_uri to return to the app. It clears the session and closes the browser, so control goes back to the app without depending on a redirect.

With a direct OpenID implementation, the redirect is handled by the service, and for iOS custom scheme URIs it isn’t always honored. That’s why you’re seeing the signed-out page even though logout is successful.

So nothing is broken in your request.

To handle this:

Don’t rely on the redirect for native apps

Treat logout as complete once the request finishes

Dismiss ASWebAuthenticationSession and navigate the user in-app

If you want the same behavior as MSAL, it needs to be handled on the client side rather than depending on post_logout_redirect_uri.