We currently use Azure AD across our corporate enviroments. We utilise SSO that signs us in to a large number of applications eg. Office 365, Devops, Freshdesk and about 30 other applications.

We have 6 internal custom web applications (all ASP.Net WebFroms 4.8) that have a custom login which hits an internal endpoint which we manually authenticate against our AD server. However, we’ve been asked to get AzureAD to directly authenticate against so that we can use MFA.

I have been able to set this up by utilising OpenIdConnect

app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions
{
    ClientId = clientId,
    Authority = authority,
    PostLogoutRedirectUri = postLogoutRedirectUri,
    
    Notifications = new OpenIdConnectAuthenticationNotifications()
    {
        AuthenticationFailed = (context) =>
        {
            return Task.FromResult(0);
        },

        SecurityTokenValidated = (context) =>
        {
            string name = context.AuthenticationTicket.Identity.FindFirst("name").Value;
            context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Name, name, string.Empty));
            return Task.FromResult(0);
        }

    }
});

This sends the user to login.microsoftonline.com for logging in and MFA. The issue that we have is that this shares the same SSO as all our other apps.

What we would like is to have these 6 applications share SSO only between these 6 applications. So if we logout of 1 app all 6 apps are logged out but we wont be logged out of other applications i.e. office 365 etc

Im assuming this is possible? I’ve tried a number of different options such as overriding the cookie options and signing out of the cookie on signout. But i think what happens here is once you become Unauthenticated you are returned to the identity provider (Azure AD) and you are still active so it immediately reauthenticates and you get a new cookie.

I’ve seen a suggestion here that you might need to create a whole new tenant and have the app registrations against that tenant so that the SSO is only against the applications on this tenant. This seems logical but then when I create it – it seems that you need to start paying to add the same set of users into it.? Additionally, we dont want to have to manage 2 sets of users from our whole organisation?

Is this even possible? Any help appreciated.