--- title: PingOne MFA IdP Adapter settings reference description: Field descriptions for the PingOne MFA IdP Adapter configuration page. component: pingone page_id: pingone:pingone_mfa_integration_kit_4.0:pf-p1-mfa-ik-p1-mfa-idp-adapter-settings-reference_4.0 canonical_url: https://docs.pingidentity.com/integrations/pingone/pingone_mfa_integration_kit_4.0/pf-p1-mfa-ik-p1-mfa-idp-adapter-settings-reference_4.0.html revdate: April 30, 2026 --- # PingOne MFA IdP Adapter settings reference Field descriptions for the PingOne MFA IdP Adapter configuration page. > **Collapse: Standard fields** > > | Field | Description | > | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | > | **PingOne Environment** | Select the PingOne connection that you created in [PingOne MFA IdP Adapter settings reference](pf-p1-mfa-ik-p1-mfa-idp-adapter-settings-reference_4.0.html).This field is blank by default. | > | **PingOne Population** | If a user does not already exist in PingOne, the adapter provisions the user to this PingOne population.Applies only when **Provision Users** is selected.This list is populated after you select the **PingOne Environment**.This field is blank by default. | > | **Application** | The PingOne application that you created in [Creating a web or native OIDC application in PingOne](pf_p1_mfa_ik_creating_a_web_or_native_application_in_p1_4.0.html).This list is populated after you select the **PingOne Environment** and **PingOne Population**.This field is blank by default. | > | **MFA Policy for Authentication** | Select the desired policy from the list. This field displays MFA policies created in PingOne. Defaults to Default, which uses the default MFA policy in PingOne. | > | **MFA Policy for Registration** | Select the PingOne MFA policy that you want to use for device pairing. | > | **MFA for Accessing from IP Out of Range** | Prompt the user for MFA if the request comes from an IP address outside of the specified range. Use CIDR notation to specify the IP address range. Multiple ranges must be separated by commas. | > | **MFA by User Population** | Prompt the user for MFA when a user is a member of any of the listed populations. Multiple populations must be separated by commas. | > | **MFA for User Attributes** | Specify the user attributes to be sent to PingOne as part of the authentication context. These attributes can be referenced within PingOne policies to determine when MFA is required. | > **Collapse: Advanced fields** > > | Field | Description | > | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | > | **Notification Template Variant Override** | Overrides the notification template variant that the adapter sends to PingOne for authentication and transaction approval flows. | > | **Test Username** | The PingOne username that the adapter uses to test the PingOne MFA connection on the **Actions** tab.Enter the username for a user that has a paired device and MFA enabled in PingOne.This field is blank by default. | > | **HTML Template Prefix** | Identifies the set of HTML templates that the adapter uses.The default value is `pingone-mfa`. | > | **Messages Files** | Identifies the customizable language-pack file that the adapter uses.The default value is `pingone-mfa-messages`. | > | **Prompt Users to Set Up MFA** | Determines whether users with no authentication methods are prompted to add one. | > | **Allow Users to Skip MFA Setup** | Determines whether the MFA setup prompt includes a **Skip** option. | > | **Allow Users to Manage Authentication Methods** | Determines whether users can add another authentication method, set an existing one as the default, or remove or rename an existing one during sign-on. | > | **Allow Users to Perform Multiple Device Management Operations Consecutively** | Select this checkbox to allow users to perform multiple device management actions without being redirected. | > | **Provision Users** | If a user does not already exist in PingOne, the adapter provisions the user to PingOne. | > | **Provision Authentication Methods** | Determines whether the adapter adds authentication methods based on the user's attribute values. | > | **Update Authentication Methods** | This setting allows the adapter to automatically add new authentication methods for existing users. | > | **Overwrite Authentication Methods Configurations** | If the adapter identifies new values for SMS, voice, WhatsApp, or email devices, this setting determines whether the adapter replaces the existing methods. | > | **Allow only predefined values for phone or email devices** | This option allows you to limit the values to the email addresses and phone numbers stored for the user. | > | **Enable Cookie Based Tracking** | When selected, the adapter tracks a previously authenticated device in a cookie. | > | **Use Password Config Attribute** | Adds a **Use Password** button to the device selection screen. | > | **Bypass MFA For Device Management Attribute** | Enter the name of the attribute that controls whether users can bypass MFA when accessing the **Device Management** page. | > | **Username Attribute** | Determines the username for users provisioned to PingOne. | > | **SMS Attribute** | The attribute name used for SMS provisioning. Default value is `sms`. | > | **Voice Attribute** | The attribute name used for Voice provisioning. Default value is `voice`. | > | **Email Attribute** | The attribute name used for Email provisioning. Default value is `email`. | > | **WhatsApp Attribute** | The attribute name used for WhatsApp provisioning. Default value is `whatsapp`. | > | **Default Authentication Method for Provisioned Users** | Sets the default method for new users. Default selection is `SMS`. | > | **User Not Found Failure Mode** | Determines whether the adapter blocks the user's sign-on attempt when a user error occurs in PingOne.In version 4.0, this setting only covers: **User does not exist**. | > | **No Devices Failure Mode** | Determines whether the adapter blocks the user's sign-on attempt or bypasses MFA authentication when the user has no usable MFA devices (no devices enrolled, or all enrolled devices are disabled in the active MFA policy) and 'Prompt Users to Set Up MFA' is not enabled.- **Bypass authentication:** The user is allowed through without MFA. > > - **Block user:** The user's authentication attempt is blocked. Your registration policy can use an MFA policy with different requirements than the MFA policy or policies that the MFA Policy for Authentication uses, so make sure to set up MFA policies that are compatible with each other. | > | **Service Unavailable Failure Mode** | When PingOne doesn't respond, determines how the adapter handles the sign-on attempt (Bypass or Block). | > | **Change Authentication Method** | Determines whether the adapter shows a "back" button to select a different method.**Columns:**- **Attribute Name:** Select from a predefined list of supported attributes. > > - **Attribute Value:** Specify the value that triggers the MFA challenge.If using **MFA by User Population** or **MFA for User Attributes**, set this to **Deny**. | > | **Show Success Screens** | Determines whether the adapter shows a success page. | > | **Show Error Screens** | Determines whether the adapter shows an error page. | > | **Show Timeout Screens** | Determines whether the adapter shows a "timed out" page. | > | **Enable Audit Log** | When selected, the adapter logs browser and authentication details in the audit log. | > | **Display One Time Devices** | Select this checkbox to display any available one-time devices on the **Device Selection** page alongside paired devices. |