---
title: Identifier-first authentication
description: Identifier-first authentication in PingOne identifies users before authenticating them and routes them to the right identity provider based on their username.
component: pingone
page_id: pingone:authentication:p1_idp_first_auth
canonical_url: https://docs.pingidentity.com/pingone/authentication/p1_idp_first_auth.html
llms_txt: https://docs.pingidentity.com/pingone/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-08-13T00:00:00Z
---

# Identifier-first authentication

With identifier-first authentication, also known as identity discovery, you can identify users before you authenticate them. You can set up rules that will take different authentication actions based on who the user is.

If the user name matches a configured rule, the system sends the user to a particular external identity provider. If the user name doesn't match a configured rule, the system sends the user to the regular password flow. For example, you could set up a rule to send employees to one identity provider, and contractors to another identity provider.

Learn more in [Adding an authentication policy](p1_add_an_auth_policy.html).