Licenses and identity limits

Ping Identity products have specific licensing limits that offer crucial protection for both customers and Ping Identity. Use the following information to understand the various licensing constraints associated with Ping Identity products and navigate and optimize their usage within the defined boundaries.

PingOne

A PingOne license includes a soft limit and a hard limit for the maximum number of identities. A license can be assigned to one or more environments, and user limits are based on the total number of identities across all of the environments assigned to a license.

The soft limit is usually 12 times the licensed Monthly Active Users (MAU) or Average Annual Users (AAU) of yourPingOnesubscription. You can continue to add users when you’ve reached the soft limit, but the system will display a warning message.

The hard limit is 10% more than the soft limit, up to the maximum limit of 50 million identities. This strict limit serves as a hard cap that you can’t exceed unless you have obtained explicit, written approval from Ping Identity. The need for this exception might arise if your subscribed MAU would theoretically allow for a hard limit exceeding 50 million identities, based on your contracted service levels. When you hit your license’s hard limit or reach 50 million identities, whichever is lower, you can no longer add users without contacting Ping Identity Sales to change your license.

Example

If your licensed MAU is 1 million, the soft limit for your license is 12 million users. The hard limit is 13.2 million users.

Approaching limit: At 10.8 million users, or 90% of the soft limit for your license, the admin console displays a warning message stating that you are at 90% of your allowed users. At this point, you can continue to add users.
Limit reached: When you reach the soft limit of 12 million users, the admin console displays another warning message stating that you have reached 100% of your allowed users. You can still add users.
Limit exceeded: When you reach 13.2 million users, which is the hard limit for the license, the admin console displays a message stating that you can no longer add users and must upgrade your license.

To receive email notifications when you are approaching these limits, configure the following alerts in Monitoring > Alerts:

Approaching User License Limit: Triggers an alert when you reach 90% of the soft limit for your license.
User License Limit Reached: Triggers an alert when you reach 100% of the soft limit for your license.
User License Limit Exceeded: Triggers an alert when you reach the hard limit for the license and can no longer add users.

Learn more in Alerts.

PingOne Authorize

PingOne Authorizeis licensed by identities, and a fair-use transaction allowance is defined for each identity tier. The fair-use transaction allowance corresponding to the total number of licensed identities is specified in your PingOne subscription.

For some authorization use cases (for example, when permissions are checked for every page access or operation), the volume of authorization events can be significantly higher than the volume of authentication events. The fair-use transaction allowance provides you and Ping Identity with a shared expectation about the volume of authorization traffic. If this limit is not sufficient, contact Ping Identity Sales about increasing the monthly allowance.

PingOne DaVinci

PingOne DaVinci is licensed by transactions based on flow invocations. A flow invocation occurs each time a flow (a series of one or more connector executions) is initiated in DaVinci. If a flow launches one or more subflows, the subflows do not count as additional invocations. Only the initial invocation is counted.

In the product dashboard and your license, a flow invocation is represented as a flow execution, and each flow invocation counts as a flow execution.

The license comes with a fair-use transaction limit of 80 connector executions (previously referred to as API calls) per flow. There is no distinction between the types of connector executions. Ping Identity reserves the right to negotiate per-invoked flow pricing for PingOne DaVinci in the event that usage exceeds flow or connector execution volume limits set in the license. If the limit is not sufficient, contact Ping Identity Sales about increasing volume limits as your usage increases. Learn more in DaVinci Usage Terms.

The DaVinci license shows your entitlements per subscription year.

Screen capture of active and in-use DaVinci licenses showing flow execution entitlements per subscription year.

The DaVinci dashboard shows the number of flow executions and connector executions that have occurred in a single environment. Use the total of all environment metrics to determine usage against the entitlements.

Screen capture of the DaVinci dashboard showing flow executions, connector executions, top flows by execution count, and top connectors by execution count for a single environment.

PingOne for Customers Passwordless

PingOne for Customers is a solution bundle that is licensed by transactions based on flow invocations (learn more in the PingOne DaVinci section). It includes using PingOne Protect, PingOne SSO (including Directory), and PingOne MFA in PingOne DaVinci. This solution bundle requires usage of each product only through DaVinci flows.