--- title: Editing an identity provider description: Use the External IdPs page in PingOne to edit an existing external identity provider. component: pingone page_id: pingone:integrations:p1_edit_idp canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_edit_idp.html llms_txt: https://docs.pingidentity.com/pingone/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-11-02T17:47:24Z page_aliases: ["p1_editidentityprovider.adoc"] section_ids: steps: Steps --- # Editing an identity provider Use the **External IdPs** page to edit an existing external identity provider (IdP) *(tooltip: \
\

A service that manages identity information and provides authentication services to relying clients or SPs within a federated or distributed network.\

\
)*. ## Steps 1. In the PingOne admin console, go to **Integrations > External IdPs** and browse for the IdP you want to edit. 2. Click the IdP to open the details panel. 3. On the **Profile** tab, click the **Pencil** icon ([icon: pencil, set=fa]) and enter or edit the following information: * **Name**: A unique identifier for the IdP. * **Description** (optional): A brief description of the IdP. * **Population**: A population that overrides the authentication policy's registration population and enables just-in-time (JIT) registration from the IdP. * **Account Linking Attribute** (custom OpenID Connect (OIDC) and SAML IdPs only): Select the **Override Default Account Linking Attribute** checkbox to use a custom attribute. * In the **Custom Account Linking Attribute** field, enter the attribute you want to use for matching an external IdP account to a PingOne user. Choose an attribute that uniquely identifies each user and that users can't change. It must begin with `providerAttributes.` and include an attribute name, such as `providerAttributes.email`. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | A mutable or non-unique value can cause PingOne to link an external IdP account to the wrong PingOne user, creating a risk of account takeover or impersonation. | * Clear the checkbox to use the default attribute of `providerAttributes.sub` for OIDC or `samlAssertion.subject` for SAML. > **Collapse: API endpoint details** > > To retrieve a user's linked external account identifier using the API, use the admin API endpoint: `/users/{userId}/linkedAccounts`. In the response, `._embedded.linkedAccounts[n].externalId` identifies the external ID for a linked account, where: > > * The leading period (`.`) is the root of the JSON output. The `linkedAccounts` array is nested under the top-level `_embedded` member. > > * `n` is the array index, indicating the `n`th IdP the user is linked to and starting at 0. > > This value is different from the top-level `.externalId` member in the user record returned by the `/user/{userId}` endpoint. Learn more in [Linked Accounts](https://developer.pingidentity.com/pingone-api/platform/users/linked-accounts/index.html) in the PingOne API documentation. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | PingOne records audit events in the Audit log for:- **Account Linking Attribute** changes. - A missing configured token claim or SAML attribute from the incoming assertion. - An inbound value it can't use, such as a value of the wrong type or a multivalued SAML attribute.Learn more in [Running an audit report](../monitoring/p1_running_audit_report.html) and [Audit Reporting Events](https://developer.pingidentity.com/pingone-api/platform/reference/audit-reporting-events.html) in the PingOne API documentation. You can also subscribe to audit events with [webhooks](p1_webhooks.html). | * **Sign-on Button** (optional): An image to be used for the sign-on button that the end user will see. Use a 300 x 42 pixel image. * **Icon** (optional): A pictorial representation of the IdP. Use a file up to 1 MB in JPG, JPEG, GIF, or PNG format. | | | | - | -------------------------------------------------------------------------------------------------------- | | | You can't change the **Icon** and **Sign-on Button**, in accordance with the provider's brand standards. | 4. Click **Save**. 5. If you edited **Account Linking Attribute**, select the checkbox in the confirmation modal and click **Continue**. 6. On the **Connection** tab, click [icon: pencil, set=fa]and enter or edit the information as needed. These values vary depending on the type of external IdP you're editing. | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | If you're using a custom domain, you can toggle the view between the custom and original URLs. The original and custom URLs will continue to work. Learn more in [Domains](../settings/p1_domains.html). | 7. Click **Save**. 8. On the **Attributes** tab, click [icon: pencil, set=fa]and enter or edit the attribute mappings, which define how the PingOne user attributes are mapped to IdP attributes. Learn more in [Mapping attributes](../directory/p1_editsamlattributemapping.html). * Enter the PingOne user profile attribute and the external IdP attribute. Learn more about attribute syntax in [Identity provider attributes](p1_idp_attributes.html). * To add an attribute, click **[icon: plus, set=fa]Add**. * To use the advanced expression builder, click the **Gear** icon ([icon: gear, set=fa]). Learn more in [Using the expression builder](../pingone_expression_language/p1_use_expression_builder.html). * Select the update condition, which determines how PingOne updates its user directory with the values from the IdP. The options are: * **Empty only**: Update the PingOne attribute only if the existing attribute is empty. * **Always**: Always update the PingOne directory attribute. 9. Click **Save**. 10. To enable or disable an IdP, click the toggle in the **External IdPs** list. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------- | | | IdPs labeled with the **Administrator IDP** badge are used for authentication into the PingOne admin console and can't be disabled or deleted. |