vCenter with Microsoft Entra ID as SSO Identity Provider does not provide a clean user logout
Article ID: 450110
Updated On:
Products
Issue/Introduction
- Users log out of vCenter and are able to log back in simply by accessing the vCenter vSphere client without entering login credentials.
Environment
VCF 9.1.x
Cause
- Logging out of the vSphere Client only ends the **local** vCenter SSO session.
- vCenter does not send a sign-out request to Entra ID's `end_session_endpoint` (OIDCRP-initiated logout), so Entra's session cookie stays valid.
- Returning to the vCenter URL afterward silently re-authenticates the user via that still-valid Entra session.
Resolution
Questions:
Is there a way to force VC to send the notification to Entra to end the token for the session on log out?
Answers:
A deep logout is not currently supported, because doing it that would log out every session the user has with Entra. SLO is usually managed by identity provider as well. Customer can consider to fully log out of Entra if they want it to be done.
There are currently no plans to support this in future VCSA builds.
- If you still desire to see this implemented, it is recommended you use our “Ideas” portal to search and see if there is already this feature request listed and vote on it, or create the “Idea” (feature request) yourself.
Possible workarounds
Browser Session Termination: Advise users to close all browser tabs or use a private/incognito window to ensure the Entra ID session token is cleared.
Manual Sign-out: Users should be able to manually navigate to the Microsoft logout page (https://login.microsoftonline.com/common/oauth2/v2.0/logout) to terminate their identity provider session.
App Registration Review: Ensure the Logout URL is correctly defined in the Entra ID App Registration, though vCenter may not yet trigger it.
Feedback
