Introduction to PingOne

In PingOne, the organization is the top-level identifier and defines your enterprise within the platform. Each organization contains one or more tenants, known as environments, which define separate working domains within an organization.

Each organization is based in a specific geographical region, such as North America, or Asia Pacific. All of the environment resources for the organization are hosted in this region. You should have organizations in each of the regions in which you operate. Learn more in IP address and domain reference.

When an organization is created, an Administrators environment is created automatically. Learn more in Environments.

After you create your organization, you can create the environments that meet the requirements of your business.

In PingOne, tenants are called environments. Environments define separate working domains within an organization and contain assets such as your PingOne services and Ping Identity products, application connections, and user identities.

An administrator role is a collection of permissions that can be assigned to a user, application, or connection, and then applied to a level, or scope, within PingOne. The combination of the role permissions and the level at which the role is applied determines what an administrator can do (permissions) and where they can do it (level or scope).

In PingOne, roles can be applied to the organization, environment, population, or application level, although not all roles can be applied at all levels.

PingOne includes a number of built-in administrator roles. These roles are not hierarchical, and there is no super admin role that has permissions to perform every action at every level in PingOne. The roles available to your organization depend on your configuration and licensing.

PingOne administrators can have multiple administrator identities across multiple environments in a single organization, a single administrator identity over multiple environments, or a combination of both. They can also have different roles that apply in those different contexts.

For some complex use cases, you might need multiple administrator identities to configure multiple organizations. An example use case is a contractor working with more than one company to configure environments. In this scenario, the contractor would need an administrator identity in each company’s organization. Similarly, if a company has organizations in multiple geographic regions, an administrator who needs to manage all of those organizations needs an identity in each organization.

If you have multiple administrator identities associated with the same email address, you can select which organization you want to authenticate to after signing on. You’ll need to choose the identity with the right permissions based on the actions you intend to take.

Learn more about administrator roles in:

Groups and populations are both used to organize users, but they differ in several ways.

A user can belong to multiple groups, but only one population. A population is a fundamental organizational unit to which you can assign a particular sign-on policy and IdP, while groups offer more fine-grained control over user access to applications.

For example, you could create two populations in your environment. One population would contain all of your finance employees, and the other would contain your engineering and support staff. You can assign each of these populations a different sign-on policy, and can also set different IdPs for each.

Within each population, you can create groups to define subsets of the population. Although a user can belong to only one population at a time, they can belong to multiple groups. These groups can then be given access to different applications. For example, in your employee population, you might have groups for different departmental organizations such as Marketing, Engineering, and Payroll.

You can create groups at the population level or the environment level. A population-level group can contain users from that population only, but an environment-level group can contain users from different populations in the same environment. Administrators who are assigned roles scoped only to the population level can create groups for those populations only and cannot create groups at the environment level.

Key differences between groups and populations are summarized in the following table:

On the Groups page, population-level groups include the name of the population under the group name.

Learn more in Groups and Populations.

The PingOne application portal is a unified interface for your users to SSO (single sign-on) to the applications you’ve added for your organization.

PingOne application portal key sections:

Administrators can use PingOne Dashboards to view and monitor activities for a service.

Learn more about the information each dashboard provides in the following sections:

PingOne Cloud Platform uses PingOne Services to help solve a wide variety of identity problems.

PingOne Solutions packages are packages of PingOne Services that are designed to help you easily manage your organization’s identity challenges by allowing you to choose the package that’s right for you, whether your organization is small with basic requirements or large with a complex deployment.

PingOne for Customers and PingOne for Workforce packages are each available in three package tiers: Essential, Plus, and Premium. You can add other PingOne Services to a package if your solution requires additional capabilities.

Every PingOne for Customers and PingOne for Workforce solution package lets you orchestrate Ping products seamlessly using PingOne DaVinci. With DaVinci, you can rapidly build, test, and optimize identity experiences using a drag-and-drop interface and no-code orchestration to weave together Ping identity services and capabilities.

We also offer solutions that combine DaVinci flows with PingOne and other tools to address complex business challenges. The PingOne for Customers Passwordless solution uses a set of tailored DaVinci flows to create a registration and sign on process that incorporates passwordless, password, and MFA options.

Learn about PingOne Solutions packages and their included capabilities: