diff --git a/docs/pages/access-controls/sso.mdx b/docs/pages/access-controls/sso.mdx
index d58f5cea38414..1eb2efea3546e 100644
--- a/docs/pages/access-controls/sso.mdx
+++ b/docs/pages/access-controls/sso.mdx
@@ -256,7 +256,6 @@ create a `cluster_auth_preference` resource.
type: saml|oidc|github
```
- (!docs/pages/includes/sso/idp-initiated.mdx!)
Create a file called `cap.yaml`:
@@ -278,7 +277,6 @@ create a `cluster_auth_preference` resource.
$ tctl create -f cap.yaml
```
- (!docs/pages/includes/sso/idp-initiated.mdx!)
@@ -294,6 +292,8 @@ based on one of the following examples.
(!docs/pages/includes/sso/idp-initiated.mdx!)
+(!docs/pages/includes/sso/saml-slo.mdx!)
+
@@ -331,6 +331,8 @@ based on one of the following examples.
(!docs/pages/includes/sso/idp-initiated.mdx!)
+(!docs/pages/includes/sso/saml-slo.mdx!)
+
diff --git a/docs/pages/includes/sso/saml-slo.mdx b/docs/pages/includes/sso/saml-slo.mdx
new file mode 100644
index 0000000000000..cf80b1ce9da51
--- /dev/null
+++ b/docs/pages/includes/sso/saml-slo.mdx
@@ -0,0 +1,9 @@
+
+ Setting the `spec.single_logout_url` endpoint in SAML connectors enables SAML SLO (Single Logout).
+ If enabled, upon logging out of Teleport, users will also be logged out of the SAML provider session, which
+ may also log them out of any other non-Teleport applications which they are currently logged into using the same SAML provider.
+
+ For optimal user experience, we recommend keeping this disabled unless necessary.
+
+ Refer to your SAML provider's documentation for instructions on where to obtain this URL.
+
\ No newline at end of file
diff --git a/examples/resources/saml-connector.yaml b/examples/resources/saml-connector.yaml
index b4ddc8415bb4a..43e94f227004a 100644
--- a/examples/resources/saml-connector.yaml
+++ b/examples/resources/saml-connector.yaml
@@ -28,4 +28,7 @@ spec:
- access
# Provides a path to the IdP metadata.
entity_descriptor_url: https://example.okta.com/app/your-app-id/sso/saml/metadata
+ # Optional SAML Single Logout endpoint. If set, logging out of Teleport
+ # will also log the user out of the SAML provider session.
+ single_logout_url: https://example.okta.com/app/your-app-id/slo/saml
\ No newline at end of file