PingOne

Provisioning Microsoft Entra ID with PingOne

Microsoft Entra ID is Microsoft’s cloud identity and access management service. By using the Entra ID connection in PingOne, you can provision users, groups, and memberships between Entra ID and PingOne.

Provisioning capabilities

The following table summarizes the inbound and outbound provisioning capabilities for each resource type:

Resource Capability Description Inbound Outbound

User

Create

Generates a new user record in the destination.

Yes

Yes

Read

Retrieves or polls user attributes for synchronization.

Yes

Yes

Update

Modifies existing attributes, such as job title.

Yes

Yes

Delete

Deletes a user or temporarily suspends an account.

Yes

Yes

Group

Create

Provisions a new group in the target application.

No

Yes

Rename

Updates the display name or identifier of an existing group.

No

Yes

Delete

Removes a group from the target application.

No

Yes

Membership

Add and remove

Adds or removes users from groups.

No

Yes

Before you begin

Make sure that you have:

  • An Entra ID administrative account.

  • The following from your Entra ID account:

    • Client ID

    • Client secret

    • Tenant ID

  • Users assigned to a specific population or group in PingOne designated for Entra ID provisioning. Learn more in Adding a user in PingOne and Managing groups.

Steps

  1. Create an Entra ID connection:

    1. In the PingOne admin console, go to Integrations > Provisioning.

    2. Click and then click New Connection.

    3. Click Select for Identity Store.

    4. Click Select for the Entra ID connection, and click Next.

    5. Enter a Name and Description for this provisioning connection.

    6. Click Next.

    7. In the Configure Authentication section, select OAUTH as the authentication method and enter the following from your Entra ID account:

      Configuration Example

      Tenant ID

      a401cea5-ecca-40a4-8562-190130df3815

      Client ID

      7b2962dd-5cba-438b-9f3a-8ba838bb1489

      Client Secret

      Ra9Dcbvws8@etcZbIkIAiXmK3q=Y5y:?

    8. Click Test Connection to verify that PingOne can establish a connection to the Entra ID resource.

      Result:

      If there are any issues with the connection, a Test Connection Failed modal opens. Click Next to resume the setup with an invalid connection.

      You can’t use the connection for provisioning until you’ve established a valid connection to Entra ID. If the connection fails, click Cancel in the Test Connection Failed modal, verify that you’ve entered the configuration details in step 1g correctly, and try again.

    9. Click Next.

    10. In the User Actions section, select the following as needed:

      Field Description

      Enable users creation

      Creates a user in the target identity store when the user is created in the source identity store.

      Enable users updation

      Updates user attributes in the target identity store when the user is updated in the source identity store.

      If Enable users updation is selected, you can choose to select Enable users disable, which disables a user in the target identity store when the user is disabled in the source identity store.

      Enable users deprovision

      Deprovisions a user in the target identity store when the user is deprovisioned in the source identity store. If Enable users deprovision is selected, the following options appear:

      • Remove Action: Removes or disables a user in the target identity store when the user is deleted in the source identity store. Select Delete or Disable.

        Remove Action is only available if you select Enable users disable.

      • Deprovision on rule deletion: Deprovisions users if the associated provisioning rule is deleted.

    11. Click Save.

    12. To enable the connection, click the toggle at the top of the details panel to the right (blue).

      You can disable the connection by clicking the toggle to the left (gray).

  2. Create an inbound or outbound rule and select the existing Entra ID connection as the target or source. You can optionally add attribute mappings.

    For an outbound rule, you can use the following example attribute mappings as a starting point.

    PingOne Directory Entra ID

    Given Name and [.codeph]Family Name

    displayName

    "true"

    forceChangePasswordNextSignIn

    User ID

    onPremisesImmutableId

    Email Address

    userPrincipalName

    "Test@123"

    password

    #string.split(username, '@')[0]

    mailNickname

    Enabled

    accountEnabled

    Given Name

    givenName

    Family Name

    surname

Validation

  • View the sync status to confirm users and groups are successfully provisioned to Microsoft Entra ID and to check for errors.

  • Review sync status examples to help interpret your results.

Entra ID directory attributes

The following table lists common Entra ID attributes that can be mapped for user provisioning:

Attribute Description

userPrincipalName

The username for the user.

givenName

The user’s first name.

surname

The user’s last name.

accountEnabled

Indicates whether the account is enabled.

mobilePhone

The user’s mobile phone number.

Entra ID provisioning known limitations

The following limitations apply to Entra ID provisioning:

  • Currently, inbound group provisioning or group membership synchronization from Entra ID to PingOne isn’t supported.

  • You must grant the required tenant permissions in the Entra admin center before the connection can be established.

  • This connection is only supported for user inbound or outbound and group or membership outbound flows. Other synchronization paths aren’t supported in this connection.

  • This connection currently doesn’t support provisioning Microsoft license assignments, such as SKU IDs and service plans, for users.