Idle timeout/explicit sign-out

[Duncan_James]

When implementing explicit sign-out and idle timeout, is it recommended to make a request to the CIS2 end_session_endpoint as well or is it enough to clear the user’s local CIS2 authentication session so they need to reauthorise next time? Also does the idle timeout apply to the Windows session or just the application session (to note, our implementation is for a native Winforms app)??