# What are the options to sign out users from the inbound federated IdP?

**URL:** <https://devforum.okta.com/t/what-are-the-options-to-sign-out-users-from-the-inbound-federated-idp/19562>\
**Category:** SAML\
**Tags:** saml, slo\
**Created:** [February 24, 2022, 10:57pm UTC](https://devforum.okta.com/t/what-are-the-options-to-sign-out-users-from-the-inbound-federated-idp/19562 "2022-02-24T22:57:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajm](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@ajm](https://devforum.okta.com/u/ajm)\
**Post date:** [February 24, 2022, 10:57pm UTC](https://devforum.okta.com/t/what-are-the-options-to-sign-out-users-from-the-inbound-federated-idp/19562/1 "2022-02-24T22:57:05Z")

</div>

There is an option in Okta to integrate with external Identity Providers like Azure AD, OneLogin using SAML 2.0 identity provider by following the instructions at:

> **[Add an external Identity Provider | Okta Developer](https://developer.okta.com/docs/guides/add-an-external-idp/saml2/main/)**
>
> Okta supports authentication with external OpenID Connect Identity Providers as well as SAML (also called Inbound Federation). Get an overview of the process and prerequisites, as well as the instructions required to set one up.

My question is related to sign out. Signing out from Okta is not signing out the user in inbound federated identity provider and i don’t see any setting to configure the logout URL that comes out of SAML identity providers metadata.

There is an article available online about SLO but based on my understanding, its not going to work in the external identity provider workflow.

> **[Configure Single Logout in app integrations | Okta](https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Single_Logout.htm)**
>
> Explains how admins can configure SAML and OIDC to handle SLO for their Okta integrations.

are there any options to initiate SAML logout from Okta to external identity providers?

#SAML #Inbound Federation #ExternalIdP

---

<div class="post-metadata">

**Author:** ![ajm](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@ajm](https://devforum.okta.com/u/ajm)\
**Post date:** [May 5, 2022, 6:08pm UTC](https://devforum.okta.com/t/what-are-the-options-to-sign-out-users-from-the-inbound-federated-idp/19562/2 "2022-05-05T18:08:06Z")

</div>

just following up if anyone got chance to look into it and have similar use case with inbound federation?

---

<div class="post-metadata">

**Author:** ![erik](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@erik](https://devforum.okta.com/u/erik)\
**Post date:** [May 5, 2022, 7:44pm UTC](https://devforum.okta.com/t/what-are-the-options-to-sign-out-users-from-the-inbound-federated-idp/19562/3 "2022-05-05T19:44:59Z")

</div>

Hello,  
The Okta SLO feature is only intended to log a user out of their current application (OIDC or SAML), and their Okta Org session. If a user authenticates into Okta via an external IdP that session will still be valid, assuming the IdP hasn’t invalidated it on its own.

After the log of Okta you can specify a redirect URI where you could try to piece together some type of chained logout of other apps/IdPs for the user, but this can be very hard to manage. Often the expectations are logging out of Okta should not effect external IdP sessions. Especially if those sessions existed prior to logging into Okta and are used for other SSO integrations.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 12, 2024, 7:29pm UTC](https://devforum.okta.com/t/what-are-the-options-to-sign-out-users-from-the-inbound-federated-idp/19562/4 "2024-02-12T19:29:24Z")

</div>