---
title: Mapping the group attribute from an external identity provider
description: You can add a mapping between the [.uicontrol]**External Group Names** attribute in PingOne and the inbound attribute name from the external IdP.
component: pingone
page_id: pingone:integrations:p1_map_group_attribute_external_idp
canonical_url: https://docs.pingidentity.com/pingone/integrations/p1_map_group_attribute_external_idp.html
revdate: April 24, 2025
section_ids:
  steps: Steps
---

# Mapping the group attribute from an external identity provider

If the external identity provider (IdP) *(tooltip: \<div class="paragraph">
\<p>A service that manages identity information and provides authentication services to relying clients or SPs within a federated or distributed network.\</p>
\</div>)* includes group information in its security tokens (ID tokens from an OpenID Connect (OIDC) *(tooltip: \<div class="paragraph">
\<p>An authentication protocol built on top of OAuth that authenticates users and enables clients (relying parties) of all types to request and receive information about authenticated sessions and users. OIDC is extensible, allowing clients to use optional features such as encryption of identity data, discovery of OpenID Providers (OAuth authorization servers), and session management.\</p>
\</div>)* IdP or assertions from a Security Assertion Markup Language (SAML) *(tooltip: \<div class="paragraph">
\<p>A standard, XML-based, message-exchange framework enabling the secure transmittal of authentication tokens and other user attributes across domains.\</p>
\</div>)* IdP), you can add a mapping between the **External Group Names** attribute in PingOne and the inbound attribute name from the external IdP.

## Steps

1. In the PingOne admin console, go to **Integrations > External IdPs** and browse or search for the appropriate IdP.

2. Click the IdP to open the details panel.

3. On the **Attributes** tab, click the **Pencil** icon.

4. Click **[icon: plus, set=fa]Add**.

5. For PingOne user profile attribute, select **External Group Names**.

6. For the external IdP attribute, enter the inbound attribute name from the external IdP.

7. For **Update condition**, select one of the following:

   * **Always**: Update the group information in PingOne every time the user authenticates from the external IdP.

   * **Empty only**: Update the group information in PingOne only if there is no value for the attribute in PingOne.

8. Click **Save**.

Learn more in [Just-in-time provisioning of external groups](../directory/p1_provision_external_groups.html).