Enabling on-the-fly registration (the MFA setup prompt)
The PingOne MFA IdP Adapter allows you to prompt users to set up their first multi-factor authentication (MFA) method. This option is referred to as on-the-fly registration, or just-in-time provisioning (JIT) registration.
About this task
To prompt a user to set up their first MFA device:
Steps
-
When Configuring an adapter instance in PingFederate:
-
In the IdP Adapter tab Advanced fields, select the Prompt Users to Set Up MFA checkbox.
-
To allow users to sign on without setting up MFA, select the Allow Users to Skip MFA Setup checkbox.
The Prompt Users to Set Up MFA configuration takes priority over the No devices failure mode configuration.
-
Result
After a user completes first-factor authentication, the adapter gets a list of the user’s second-factor authentication methods from PingOne. For users that don’t have any existing authentication methods, the MFA setup prompt appears.
The user can click Setup, then select the type of authentication method they want to add. You can include an optional Skip button if you don’t want to force users to set up MFA.
Next steps
To use the MFA setup prompt in an authentication policy, make sure to add the P1 MFA IdP adapter to your authentication policy and configure an MFA step.