--- title: Cross-protocol logout description: Learn about cross-protocol logout for applications in PingOne. component: pingone page_id: pingone:applications:p1_cross_protocol_logout canonical_url: https://docs.pingidentity.com/pingone/applications/p1_cross_protocol_logout.html llms_txt: https://docs.pingidentity.com/pingone/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-10-29T18:40:15Z section_ids: cross-protocol-logout-endpoint: Cross-protocol logout endpoint supported-outgoing-logout-requests: Supported outgoing logout requests asynchronous-logout-messages: Asynchronous logout messages saml-2-0-slo-process: SAML 2.0 SLO process endpoint-availability-and-request-parameters: Endpoint availability and request parameters additional-configuration-options: Additional configuration options --- # Cross-protocol logout Cross-protocol logout ensures that when a user signs off from PingOne, a specific application, or an external SAML identity provider (IdP), they're seamlessly signed off from all other connected applications and IdPs associated with the same session. This works even when the applications and IdPs use different single sign-on (SSO) protocols. PingOne supports cross-protocol logout across the following: * OpenID Connect (OIDC) applications * WS-Fed applications, including Microsoft 365 applications that use the passive profile through the WS-Fed protocol * SAML applications and identity providers (IdPs) Cross-protocol logout helps prevent users from remaining signed on to applications after they sign off from PingOne. It also provides a more consistent single logout (SLO) experience across SSO protocols and helps organizations enforce strict session-termination policies. ## Cross-protocol logout endpoint To explicitly trigger cross-protocol logout, send an HTTP GET request to the PingOne application `/xp/signoff` endpoint. The request must include a valid session token (ST) cookie. PingOne uses the ST cookie to retrieve the applications and IdPs the user has signed on to in the same session. It then sends logout requests to those applications and IdPs, as listed in the following section. Learn more in [Signoff (Cross-Protocol)](https://developer.pingidentity.com/pingone-api/auth/openid-connect-oauth-2/authorization/get-signoff-cross-protocol.html) in the PingOne API documentation. ### Supported outgoing logout requests PingOne can send the following types of logout requests: * OIDC front-channel logout requests to OIDC applications, as defined in the [OIDC Front-Channel Logout 1.0 specification](https://openid.net/specs/openid-connect-frontchannel-1_0.html) * WS-Fed `wa=wsignoutcleanup1.0` cleanup requests to WS-Fed applications * SAML 2.0 SLO requests to and from SAML applications * SAML 2.0 SLO requests to and from SAML IdPs ### Asynchronous logout messages PingOne sends logout messages asynchronously and in parallel. PingOne sends these messages only when the application or IdP has the required endpoint configured as follows and when the user's sign-on is within the last 24 hours: * OIDC applications must each have a **Front-Channel Logout URI** configured for PingOne to send them OIDC front-channel logout requests. Learn more in [Editing an application - OIDC](p1_edit_application_oidc.html#p1_front_channel_logout). * WS-Fed applications must each have an **SLO Endpoint** configured for PingOne to send them `wa=wsignoutcleanup1.0` cleanup requests. Learn more in [Create Application (WS-Federation Protocol)](https://developer.pingidentity.com/pingone-api/platform/applications/applications-1/create-application-ws-federation-protocol.html) in the PingOne API documentation. ### SAML 2.0 SLO process After sending asynchronous logout messages, PingOne processes SAML 2.0 SLO requests sequentially: 1. PingOne sends requests to SAML IdPs and processes their responses. 2. PingOne sends requests to SAML applications and processes their responses. For PingOne to send a SAML 2.0 SLO request, each SAML application or IdP must have an **SLO Endpoint** configured. The user's sign-on must be within the **SLO Window** configured for that application or IdP. The window defaults to 2 hours and can be set from 1 to 24 hours. Learn more in [SAML 2.0 single logout](p1_saml_2_0_slo.html). ### Endpoint availability and request parameters The `/xp/signoff` endpoint always works, regardless of whether you enable the **Cross-protocol logout** setting in the PingOne admin console. Learn more in [Configuring logout settings](../authentication/p1_authentication_settings.html#configuring-logout-settings). Requests to the `/xp/signoff` endpoint must include a valid ST cookie. You can include the `post_logout_redirect_uri` request parameter to specify where to redirect the browser after sign-off. PingOne always validates its value against the **Centralized post logout redirect URIs** you added in the admin console. PingOne ignores other request parameters, including `id_token_hint`. ## Additional configuration options You can further customize cross-protocol behavior as follows: * Configure PingOne to trigger cross-protocol logout when it receives an applicable logout request directly from a connected application or SAML IdP. * Manage post-logout redirect destinations centrally to ensure users are redirected to a designated page after sign-off. Learn more in [Configuring logout settings](../authentication/p1_authentication_settings.html#configuring-logout-settings).