The less commonly built half of the federation problem
Single sign-out propagates a logout across every application a federated identity was signed into, rather than ending only the session in whichever application the user happened to trigger the logout from. Without it, someone who reasonably believes they've logged out everywhere may still have live, fully authenticated sessions running in other applications that never received any indication the underlying identity had signed out at all.
This gap matters more than it might initially seem to, because it directly undermines the mental model single sign-on itself is built to create: one identity, one login, one logout — and a logout that only partially works breaks exactly the promise the whole federated setup was supposed to deliver.
Why this is structurally harder than the login side
Reliable single sign-out requires the identity provider to notify every relying application of the logout event, and each application to actually act on that notification promptly and correctly — a chain with considerably more points of potential silent failure than the original login flow has, and a failure that goes unnoticed far more often, because a session that fails to properly end just keeps quietly working rather than throwing an obvious, visible error the way a broken login typically does.