Microsoft Entra ID SAML SLO: with 2+ signed-in accounts, Entra sends a LogoutRequest (not a LogoutResponse) to the initiating SP's Logout URL

Question

Microsoft Entra ID SAML SLO: with 2+ signed-in accounts, Entra sends a LogoutRequest (not a LogoutResponse) to the initiating SP's Logout URL

Jun Huynh 20

Environment

IdP: Microsoft Entra ID (SAML 2.0 single sign-out, HTTP-Redirect binding)
SP: our application (Entity ID / Issuer: https://sp.example.com)
SLO "Logout URL" registered in the enterprise app: https://sp.example.com/saml/logout
Single SP / single enterprise app; one user identity (NameID) per test
Browser: Chromium-based

Context

We implement SP-initiated SAML Single Logout. The SP sends a LogoutRequest to Entra's SLO endpoint (HTTP-Redirect), and handles inbound messages on the registered Logout URL.

Scenario A — ONE Microsoft account signed in (works as documented)

SP redirects the browser to Entra with an SP-initiated LogoutRequest:

<samlp:LogoutRequest ID="id-..." ...>
<saml:Issuer>https://sp.example.com</saml:Issuer>
<saml:NameID Format="...persistent">REDACTED</saml:NameID>
<samlp:SessionIndex>_xxxxxxxx-aaaa</samlp:SessionIndex>
</samlp:LogoutRequest>

Entra replies with a LogoutResponse delivered to our Logout URL (SAMLResponse=...), InResponseTo = the ID of our request, Status = Success.
Logout completes and the user is redirected back to our app. ✅

Scenario B — TWO or more Microsoft accounts signed in (problem)

Same SP-initiated LogoutRequest as above.
Entra shows the "Pick an account — Which account do you want to sign out of?" page. We select the account.
Instead of a LogoutResponse, Entra loads our Logout URL inside a hidden iframe with a LogoutRequest (SAMLRequest=..., signed):

<samlp:LogoutRequest ID="_yyyyyyyy-bbbb" ...
       Destination="https://sp.example.com/saml/logout">
<Issuer>https://sts.windows.net/<tenant-id>/</Issuer>
<NameID Format="...persistent">REDACTED</NameID>
<samlp:SessionIndex>_xxxxxxxx-aaaa</samlp:SessionIndex>
</samlp:LogoutRequest>

Note: the SessionIndex (_xxxxxxxx-aaaa) is identical to the one our SP-initiated LogoutRequest carried - i.e. it targets the very session that initiated the logout.

Our SP answers with a Success LogoutResponse back to Entra's /saml2 endpoint, which returns HTTP 200 "OK". But the top-level browser is never redirected back to our app and stays on the Entra /logoutsession page.

Expected behavior

Per the documentation:

"If one of the other participants sends a LogoutRequest to the Microsoft identity platform (the session authority), it will send a LogoutRequest back to all the session participants except the participant who sent the initial LogoutRequest."

Since our SP is the participant that sent the initial LogoutRequest (and the SessionIndex matches), we expect Entra to return a LogoutResponse to our Logout URL exactly as in Scenario A rather than sending us a new LogoutRequest.

Actual behavior

With 2+ signed-in accounts, after the "Pick an account" step, Entra sends a LogoutRequest (via hidden iframe) to the initiating SP's Logout URL for the same SessionIndex, instead of a LogoutResponse. No final top-level redirect back to the SP occurs.

Question

Why, in the multi-account case, does Entra send a LogoutRequest to the initiating SP's Logout URL (the participant that sent the initial LogoutRequest) instead of a LogoutResponse, which appears to contradict the "except the participant who sent the initial LogoutRequest" statement in the docs? Is this expected behavior after the "Pick an account" selection, and if so, what is the supported way to complete SP-initiated SLO (and return the user to the SP) in this scenario?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

VEMULA SRISAI 13,985 Microsoft External Staff Moderator

Hello Jun Huynh,

You’re observing expected behavior in Microsoft Entra ID, even though it looks inconsistent with the documentation at first glance.

In Scenario A (single account), Entra can maintain a clear SP‑initiated logout transaction, so it returns a LogoutResponse to your SP as expected. However, in Scenario B (multiple signed-in accounts), the flow changes after the**“Pick an account”** step. At that point, Entra no longer continues the original SP‑initiated transaction. Instead, it effectively starts a new, IdP‑driven logout flow and performs front‑channel logout across session participants.

As part of this front‑channel SLO implementation, Entra can send LogoutRequest messages (via hidden iframe) to registered logout URLs, even to the SP that initiated the logout. This aligns with the platform’s requirement that applications must always be able to handle incoming LogoutRequest messages, regardless of who initiated the flow.

Because this is a front‑channel (iframe-based) propagation, it does not guarantee a final top-level redirect back to your SP, which is why the browser remains on the Entra /logoutsession page even though your SP responds successfully.

How to handle this correctly

Your SP should support both LogoutRequest and LogoutResponse and not rely only on receiving a LogoutResponse.
Treat an incoming LogoutRequest (even for the same SessionIndex) as a valid signal to terminate the session.
Do not depend on Entra to always redirect the user back to your application after logout.
If a consistent UX is required, minimize multi-account scenarios (for example, by avoiding the account picker where possible).

Conclusion

This behavior is expected in multi-account scenarios due to Entra’s front‑channel logout orchestration. The “exclude initiating participant” rule applies only when the original SLO transaction is preserved end‑to‑end, which is not the case after account selection.

Jun Huynh 20 Reputation points

2026-06-22T07:32:21.66+00:00
Hi @VEMULA SRISAI , thanks a lot for your reply earlier, that was really helpful and cleared up my previous question.

One more question if you don't mind. It's about the LogoutResponse <Issuer> documented here.

The doc says Entra sets it to:

https://login.microsoftonline.com/<TenantIdGUID>/

But when our SP validates the LogoutResponse issuer against that value, it does not work, single logout fails. We only got it working after switching the expected issuer to:

https://sts.windows.net/<TenantIdGUID>/

which is the same value Entra puts on the login SAML assertion.

So my questions are:

Is sts.windows.net/<TenantIdGUID>/ actually the expected LogoutResponse issuer, and is the doc out of date?

Is this value stable, or could Entra return the documented login.microsoftonline.com/<TenantIdGUID>/ form in some cases (per tenant/region/future change)? If so, what's the recommended issuer-validation approach?

Thanks again!
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-06-22T09:17:57.31+00:00
Yes — what you observed is correct, and your finding is valid.

In Microsoft Entra ID SAML flows, the issuer value https://sts.windows.net/<TenantId>/ is expected and commonly used, including in LogoutResponse messages.

Although the documentation references https://login.microsoftonline.com/<TenantId>/, in practice:

Entra ID uses sts.windows.net as the Security Token Service (STS) for SAML assertions and logout messages.

This is the same issuer you see in SAML login responses as well, ensuring consistency across SAML operations.

Recommended Approach

Your implementation using https://sts.windows.net/<TenantId>/ is correct and supported.

Avoid strict validation against only one issuer string.

Instead:

Validate using the IdP signing certificate (primary trust)

Ensure the issuer belongs to your tenant (tenant ID match)

Answer to your questions

Is sts.windows.net/<TenantId>/ expected? Yes — this is the correct and commonly returned issuer for SAML flows.

Can login.microsoftonline.com/<TenantId>/ appear? ⚠️ It may appear depending on implementation changes, but currently SAML primarily uses sts.windows.net.

Your fix is correct — continue using sts.windows.net/<TenantId>/.

For long-term stability, implement flexible issuer validation instead of hardcoding a single value.
VEMULA SRISAI 13,985 Reputation points Microsoft External Staff Moderator

2026-06-22T09:20:08.04+00:00

Jun Huynh If the resolution was helpful, kindly take a moment to click on

and click on Yes for was this answer helpful. And, if you have any further query do let us know.

Microsoft Entra ID SAML SLO: with 2+ signed-in accounts, Entra sends a LogoutRequest (not a LogoutResponse) to the initiating SP's Logout URL

How to handle this correctly

Conclusion

Recommended Approach

0 additional answers

Your answer