--- title: Configuring multiple access mode description: Enter these setting in PingFederate to configure multiple access mode. component: pingid page_id: pingid:pingid_integrations:pid_configuring_multiple_access_mode canonical_url: http://docs.pingidentity.com/pingid/pingid_integrations/pid_configuring_multiple_access_mode.html revdate: March 15, 2023 section_ids: before-you-begin: Before you begin steps: Steps choose-from: Choose from: result: Result --- # Configuring multiple access mode Enter these setting in PingFederate to configure multiple access mode. ## Before you begin Multiple access mode is supported from the following software versions: * PingFederate 9.2 or later * PingID Integration Kit 2.6 (PingID Adapter 2.5) ## Steps 1. Configure PingFederate to determine whether the accessing device is organization-owned, and whether it is a private or shared device. Choose from the following methods to obtain this information. ### Choose from: * Reference the source IP address. For more information, see [Configure the CIDR Authentication Selector](http://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/pf_config_cidr_auth_selector.html). * Inspect the global HTTP header. For more information, see [Configure the HTTP Header Authentication Selector](http://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/pf_config_http_header_auth_selector.html). * Information returned by a mobile device management (MDM) system. Refer to the documentation for the following MDM Integration Kits available for PingFederate: * MobileIron: [Configuring MobileIron for PingID MDM integration](../pingid_service_management/pid_configuring_mobileron_mdm_integration.html) * Workspace ONE UEM (formerly known as AirWatch): [Configuring Workspace ONE UEM for PingID MDM integration](../pingid_service_management/pid_configuring_workspace_one_uem_for_mdm_integration.html) * Inspect the distinguished name (DN) of the accessing device. 2. Configure multiple access mode. 1. Download the PingID properties file. For more information, see [Managing the PingID properties file for PingFederate](pid_pf.html). 2. Create an HTML form adapter instance. Refer to [HTML Form Adapter](http://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/pf_html_form_adapt.html) and [Configuring an HTML Form Adapter instance](http://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/pf_config_html_form_adapt_instance.html) in the PingFederate admin guide. Make sure that: * **Session State** is set to **None**. * **Enable 'This is my device'** box is selected. 3. Configure authentication sessions for the HTML Form Adapter. For more information, see [Configuring authentication sessions](http://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/pf_config_auth_sessions.html). 4. Create a PingID adapter instance. For more information, see [Configuring a PingFederate policy for secondary authentication](configuring_a_pf_policy_for_secondary_auth.html). Make sure that: * **Type** is set to **PingID Adapter 2.5** or later, to support multiple access mode. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The multiple access mode capability requires PingFederate Authentication Policies rather than the Composite adapter:- Create an Authentication Policy Contract (APC). For more information, see [Policy contracts](http://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/pf_policy_contracts.html). - Create an authentication policy for the PingID adapter. For more information, see [Policies](http://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/qmq1564002987890.html). | ## Result The following table summarizes the main flows, based on the attributes of the accessing device. These attributes are assessed to determine the use case, and whether the device is organization-owned, single or multi-user, or whether these attributes are unknown: | Accessing device attributes | | | Process flow | | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Use case scenario | Organization-owned device | Single/Multiple user device | HTML login form presents 'This is my device' checkbox | Session information saved | | `Private accessing device`: Each access device is organization-owned, and assigned to only one user. | Yes | Single user | No | Yes | | `Shared accessing device`: Access devices are organization-owned, and each device is identifiable before login at access time, as a multiple-user shared device. | Yes | Multiple users | No | No | | `Unknown accessing device`: Access is permissible from devices whose status as a single-user or multi-user device is not identifiable before login at access time.These devices may also be either organization-owned privately owned.Since PingFederate cannot determine whether the access device is private or shared, the user is prompted at login to indicate the device status. | In this use case, the behavior is identical regardless of whether or not the access device is organization-owned. | Unknown whether single or multiple user device, when PingFederate presents the HTML login form | Yes | Depends on the user's response:- Yes: If the user checks **'This is my device'**. - No: If the user leaves **'This is my device'** unchecked. |