Hi @Daus Shah 

1. Do I need to export new metadata XML?

Not necessarily. The metadata XML that you download from Microsoft Azure contains your identity provider (IdP) details (Azure login URL, logout URL, and your public certificate). Unless you've changed the signing certificate or the actual endpoints of the Azure tenant, the XML file itself remains the same.

However, even if the file is the same, the configuration settings within that file must be mapped correctly in the ODC. If you've made changes to your app registration in Azure (like adding the ODC response URL), those changes are "live" on the Azure side and generally don't require a new XML download unless the SSO URLs themselves change.

2. Can I use the same configuration for O11 and ODC?

We highly recommend using separate application registrations in Azure for O11 and ODC.

While it is technically possible to add multiple redirect URIs and logout URLs to a single Azure application registration, this often leads to the exact error you are seeing. Here's why:

Entity ID mismatch: O11 and ODC have different unique identifiers (entity IDs). Using an application registry to represent two different "service providers" (O11 and ODC) confuses session management in Azure.

Logout URL Conflicts: SAML Single Logout (SLO) typically expects a single logout URL. If Azure is trying to send the logout response back to an O11 endpoint when the request comes from the ODC, the session handshake will fail.

Troubleshooting Logout Error (AADSTS50070)

The "Logout Failed" error typically occurs due to a mismatch in the logout URL or SAML request signature. Follow these steps to resolve it in ODC:

Step 1: Create a Dedicated App Registration

Create a brand new App Registration in Azure specifically for ODC. This keeps your O11 production environment safe while you configure ODC.

Step 2: Verify the Logout URL

In Azure, under Authentication > Front-channel logout URL, ensure you have the correct ODC logout endpoint.

In ODC, go to the Identity Providers settings.

Copy the Service Provider Logout URL provided by ODC.

Paste this into the Azure App Registration.

Step 3: Check the "Session Index"

ODC sends a specific SessionIndex in the SAML Logout Request. If Azure doesn't "remember" that index from the login phase, it rejects the logout. This often happens if:

The Identifier (Entity ID) in ODC does not exactly match the Identifier (Entity ID) in Azure.

The login was performed using one App Registration, but the logout configuration is pointing toward settings shared with O11.

Hope this helps

Hi @Daus Shah ,

The logout issue happens because SAML works differently in OutSystems ODC than it does in OutSystems 11. Even if login works using the same metadata, logout won’t behave the same way.

A few things usually fix it:

• Don’t reuse the O11 SAML metadata in ODC. ODC has its own identity and session handling, so you should always generate and use the ODC-specific Service Provider metadata when configuring your identity provider (like Azure AD / Entra).

• Make sure Single Logout (SLO) is properly configured. The logout URL provided by ODC must be set correctly in the identity provider, and the bindings (POST/Redirect) need to match. If SLO isn’t set up, the user will appear logged in because the IdP session is still active.

• Check the identity provider scope in ODC. In ODC, SAML providers are assigned to a scope (organization or stage). If the scope isn’t correct, login and logout behavior can look inconsistent.

• Be aware of how logout works in ODC. Logging out of the app ends the OutSystems session, but unless SLO is configured, it doesn’t automatically log the user out of the identity provider - so they can get logged back in immediately.

In short: login working doesn’t mean logout is fully configured. Use ODC’s own metadata, configure Single Logout properly, and don’t assume O11 and ODC behave the same.

Hope this helps,

regards,

Manish Jawla