PingOne administrators MFA requirement - FAQ

PingOne administrators currently using PingOne sign-on policies to authenticate to the admin console will be required to enable MFA.

During the transition period, administrators sign on to the console, they will be presented with the option to enable mandatory MFA for administrators on a per-environment basis. After the transition deadline, an updated default sign-on policy that requires a second authentication method to be registered and used will be automatically applied to all PingOne environments that do not have mandatory MFA for administrators enabled.

We are making specific methods from the PingOne MFA service (Ping Identity’s customer identity MFA product) available for all administrators of the Ping Identity Platform.

The following authentication methods are available for the Administrators environment include:

Some PingOne environments are still using FIDO and must update to a FIDO2 policy to use FIDO2 for administrator sign on. Because it can introduce breaking changes, this is a manual opt-in. Customers must follow these steps to enable FIDO2. FIDO (original) devices will continue to work for administrator authentication, but the new administrator MFA policy will not allow just-in-time (JIT) registration of new FIDO (original) devices. After the new policy has been enabled, it will allow JIT registration of FIDO2 devices.

Only email and push notifications will be available for environments that do not have an administrator license and that are not licensed for PingOne MFA.

Customers do not need to be licensed for PingOne MFA to use MFA for administrator sign-on.

If you are licensed for PingOne MFA, you can add additional methods for authentication, such as FIDO2, to the applicable sign-on policy.

Ping recommends storing all administrator identities in the administrator environment and enforcing phishing-resistant verification methods, such as push notifications or FIDO2.

All administrator users of PingOne.

We strongly believe that security is paramount and are taking steps to ensure that this process is seamless for all our customers. As such, no exceptions will be made. However, we are soliciting feedback from all customers to inform the timeline needed to adapt to this change. Ping Identity will require MFA for all PingOne administrators in 2025.

Administrators will be able to enable and disable administrator security settings on a per-environment basis for all environments until the end of the transition period when the new Administrator Settings page is available in PingOne.

After the transition deadline, an updated default sign-on policy that requires a second authentication method to be registered and used will be automatically applied to all PingOne environments that do not have mandatory MFA for administrators enabled. This policy cannot be disabled.

Ensure all administrators have MFA devices registered (email, TOTP, FIDO2).

Enable the new settings early so that all changes are transparent when the transition deadline passes.

Ping will communicate with all customers when the new security settings management page and inline MFA registration become available.

If you are using an external identity provider (IdP) as your primary authentication source, you do not need to set up MFA in PingOne because you can set up MFA in your external IdP.

When the administrator MFA security setting is enabled, PingOne will update the location where the authentication policy is configured but no additional changes will be needed. Authentication using the external IdP will remain unchanged.

A new chip will appear on the external IdP connection in Integrations → External IDPs. Deleting or disabling the connection will be prevented when assigned to the administrative console system application.

The table below describes how existing sign-on policy configurations will map to the new platform sign-on policy for administrators.

The sign-on experience for administrators authenticating to PingOne will look and function the same as it does today with one exception: administrators who are used to authenticating with an identifier-first sign-on page (username only) will now be presented with a form to enter username and password.

If the administrator does not already have a relevant MFA method registered (email, FIDO2, or TOTP), they will be walked through the process of registering an MFA method at their next sign-on attempt.

Subsequent sign-on attempts will require a second factor for verification.

We are currently soliciting feedback from all customers to inform the timeline needed to adapt to this change. Ping Identity will require MFA for all PingOne administrators in 2025.

Existing customers will have access to an early-access preview within the product to adopt the change on an earlier time frame and will be notified when the new settings become available.

All Terraform providers distributed and managed by Ping Identity will be updated by the time enforcement is mandatory for all customers.

Contact your customer success representative or account executive.