---
title: Enabling provisioning in PingFederate
description: To use PingFederate for provisioning, configure an external datastore and enable outbound provisioning.
component: pingone
page_id: pingone:pingone_integration_kit:pf_p1_ik_enabling_provisioning_in_pf
canonical_url: https://docs.pingidentity.com/integrations/pingone/pingone_integration_kit/pf_p1_ik_enabling_provisioning_in_pf.html
revdate: June 18, 2024
section_ids:
  about-this-task: About this task
  steps: Steps
---

# Enabling provisioning in PingFederate

To use PingFederate for provisioning, configure an external datastore and enable outbound provisioning.

## About this task

Your external datastore acts as the source of data for provisioning. PingFederate also uses an internal datastore to store the state of synchronization between the source datastore and the target datastore.

Learn more in [Datastores](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_datastores.html) and [Configuring outbound provisioning settings](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/help_protocolsettingstasklet_saasglobalprovisioningsettingsstate.html) in the PingFederate documentation.

## Steps

1. Configure the external datastore that PingFederate will use as the source of user data.

   Learn more in [Adding a new datastore](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/help_datasourcetasklet_selectdatasourcetypestate.html) in the PingFederate documentation.

   |   |                                                                                                                                                                                                                                                                        |
   | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   |   | When targeting users and groups for provisioning, exclude the user account that you will use to administer users in your connection to PingOne. This prevents the PingFederate provisioning engine from interfering with the account that provisions users and groups. |

2. Go to **System > Server > Protocol Settings**.

3. On the **Outbound Provisioning** tab, select the PingFederate internal datastore, then click **Save**.

   Learn more in [Configuring outbound provisioning settings](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/help_protocolsettingstasklet_saasglobalprovisioningsettingsstate.html) in the PingFederate documentation.