PingOne

Installing the PingID desktop app

This section documents the new PingID desktop application.

Install PingID desktop app for PingOne

Installing the PingID desktop app requires administrative privileges. You can install it using the command-line interface (CLI) or the UI.

Windows CLI

About this task

This section describes how to perform a silent (non-interactive) installation and configuration of the PingID desktop app on Windows using the CLI. This method is intended for enterprise deployment, batch scripting, and management tools, such as SCCM or Intune.

Before you begin

  • You must run all CLI commands as an Administrator.

  • Administrators can chain multiple commands together using the && operator in batch or modern PowerShell (7.x or later) scripts. This ensures that each command runs only if the previous one succeeds.

You can find information on supported platforms and general requirements in PingID desktop app requirements and limitations.

Installation steps and CLI parameters

The application is provided in two distinct packages:

  • .msi installer (standardized by the Windows Installer service).

  • .exe installer (a custom setup program)

Choose the method that best suits your deployment environment.

  • msi

  • exe

Steps

  1. From the PingID downloads page, download the PingID desktop app installer file (.msi) relevant to the target Windows machine (x64, or arm64).

  2. Open a Command Prompt or PowerShell window with administrative privileges.

  3. Execute the installer directly by providing the file path and all configuration parameters in the argument list.

# Example: Full enterprise deployment (silent, and manual proxy configuration for a Windows Intel (x64) machine)
msiexec /i PingIdDesktop_1.0.0.x.x64.msi /quiet ProxyMode=1 ProxyAddress=http://proxy.corp.net:8080

Windows CLI parameter reference for MSI

The parameters used during a new installation command block can also be used during an upgrade. All configuration is performed using installer arguments.

Installer parameters

The installer uses the following parameters to control installation and configuration actions.

Parameter Valid values Description

/quiet

Performs a silent installation.

/L*v <name_of_log_file>

Creates a verbose log file detailing installation actions. If a path is specified, the log is written to that path; otherwise, it’s created in the current directory.

DIR=<full_dirpath>

String (fully qualified path)

Defines the custom installation path (for example, x:\directorypath).

Port

Integer [1024 - 65535] (default: 9410)

Specifies the desktop app service’s local listening port. Must match the Communication Port value defined in the PingOne admin console.

ProxyMode

Integer [0 - 3]

Defines the internet connection method.

Possible values:

  • 0 = Direct: Use a direct internet connection.

  • 1 = Manual: Requires an explicit proxy URI (for example, http://proxy.example.com:8080). Requires host and port.

  • 2 = PAC: Requires a Proxy Auto-Config (PAC) file URL (http, https, or file). For example, https://wpad.corp.local/proxy.pac or file:///path/to/proxy.pac.

  • 3 = Auto Detect: Uses the system-provided settings (WPAD, Group Policy). User credentials are required if the proxy requires authentication.

ProxyAddress

String (URI)

The full URI (Uniform Resource Identifier) for the proxy configuration. This value must include the protocol (for example, http://) and represents the required address based on the Proxy Mode used:

  • For Manual mode (1): The value represents the proxy server address and port. (for example, http://10.1.1.1:9410)

  • For PAC mode (2): The value represents the URL of the PAC file. (for example, https://wpad.corpnet/proxy.pac or file:///path/to/proxy.pac)

ProxyUsername

String (proxy user)

Proxy account username, required if proxy authentication is enforced.

ProxyPassword

String (proxy password)

Proxy account password, required if proxy authentication is enforced.

ProxyBypass

Integer

Defines whether the administrator allows the user to bypass the enterprise proxy.

Values:

  • 0 (default): Deny. Don’t allow users to bypass the enterprise. The proxy toggle doesn’t appear on the desktop app menu.

  • 1: Allow. Allows the user to use or bypass the desktop app. If a proxy configuration is defined the proxy bypass option displays on the desktop app menu.

Timeout

Integer [15 - 180] seconds (default: 30)

Sets the operation timeout (during registration or authentication) for Windows Hello dialogs. The operation is canceled if the timeout value is reached.

/NORESTART

N/A (Switch only)

Prevents the target machine from rebooting after installation.

Steps

  1. Download the PingID desktop app installer file (.exe) from the PingID downloads page.

  2. Open a Command Prompt or PowerShell window with administrative privileges.

  3. Execute the installer directly by providing the file path and all configuration parameters in the argument list.

The most effective method for enterprise deployment is to place this command within an Intune or SCCM script. 
# Example: Full enterprise deployment (silent, and manual proxy configuration)
PingIdDesktop_1.0.0.x.exe /VERYSILENT /ProxyMode=1 /ProxyAddress=http://proxy.corp.net:8080

Windows CLI parameter reference

The parameters used during a new installation command block can also be used during an upgrade. All configuration is performed using installer arguments.

Installer parameters

The installer uses the following parameters to control installation and configuration actions.

Parameter Valid values Description

/SILENT or /VERYSILENT

N/A (Switch only)

Executes the installer without displaying the setup wizard or progress bar.

  • /SILENT: Hides the background window but shows the installation progress window.

  • /VERYSILENT: Hides both the background window and the installation progress window (ideal for scripted deployment).

/SUPPRESSMSGBOXES

N/A (Switch only)

Suppresses message boxes. This parameter is only effective when combined with /SILENT or /VERYSILENT.

/SP-

N/A (Switch only)

Disables the initial "This will install…​ Do you wish to continue?" prompt.

/LOG=<full_output_log_filepath>

File path

Creates a log file detailing installation actions. If a path is specified, the log is written to that path; otherwise, it is created in the user’s TEMP directory.

/DIR=<full_dirpath>

String (fully qualified path)

Defines the custom installation path (for example, x:\directorypath).

/Port

Integer [1024 - 65535] (default: 9410)

Specifies the desktop app service’s local listening port. Must match the Communication Port value defined in the PingOne admin console.

/ProxyMode

Integer [0 - 3]

Defines the internet connection method.

Possible values:

  • 0 = Direct: Use a direct internet connection.

  • 1 = Manual: Requires an explicit proxy URI (for example, http://proxy.example.com:8080). Requires host and port.

  • 2 = PAC: Requires a Proxy Auto-Config (PAC) file URL (http, https, or file). For example, https://wpad.corp.local/proxy.pac or file:///path/to/proxy.pac.

  • 3 = Auto Detect: Uses the system-provided settings (WPAD, Group Policy). User credentials are required if the proxy requires authentication.

/ProxyAddress

String (URI)

The full URI (Uniform Resource Identifier) for the proxy configuration. This value must include the protocol (for example, http://) and represents the required address based on the Proxy Mode used:

  • For Manual mode (1): The value represents the proxy server address and port. (for example, http://10.1.1.1:9410)

  • For PAC mode (2): The value represents the URL of the PAC file. (for example, https://wpad.corpnet/proxy.pac or file:///path/to/proxy.pac)

/ProxyUsername

String (proxy user)

Proxy account username (required if proxy authentication is enforced).

/ProxyPassword

String (proxy password)

Proxy account password (required if proxy authentication is enforced).

/ProxyBypass

Integer

Defines whether the administrator allows the user to bypass the enterprise proxy.

Values:

  • 0 (default): Deny. Don’t allow users to bypass the enterprise. The proxy toggle doesn’t appear on the desktop app menu.

  • 1: Allow. Allows the user to use or bypass the desktop app. The proxy bypass option appears on the desktop app menu.

/Timeout

Integer [15 - 180] seconds (default: 30)

Sets the operation timeout (during registration or authentication) for Windows Hello dialogs. The operation is canceled if the timeout value is reached.

/NORESTART

N/A (Switch only)

Prevents the target machine from rebooting after installation.

Use cases

The following use cases demonstrate how to use the installer with configuration parameters for common enterprise deployment needs.

  • msi

  • exe

Use case 1: Silent install with custom port

Performs a silent installation, logs output, and sets the service listening port to 9411 on a Windows Intel(x64) machine.

msiexec /i PingIdDesktop_1.0.0.x.x64.msi /quiet Port=9411 /L*v installer.log

Use case 2: Install with manual proxy and custom timeout

Performs a silent installation, logs output, sets manual proxy mode, proxy address, and increases timeout to 45 seconds on a Windows Intel(x64) machine.

msiexec /i PingIdDesktop_1.0.0.x.x64.msi /quiet ProxyMode=1 ProxyAddress=http://10.1.1.1:8080 Timeout=45 /L*v installer.log

Use case 3: Install with PAC proxy configuration

Performs a silent installation, logs output, sets PAC proxy mode, and specifies PAC file URL on a Windows ARM64 machine.

msiexec /i PingIdDesktop_1.0.0.x.arm64.msi /quiet ProxyMode=2 ProxyAddress=http://10.1.1.1:8080/my.pac /L*v installer.log

Use case 4: Full deployment (custom port, PAC proxy, proxy authentication, and proxy bypass)

Performs a silent installation, logs output, sets custom port, PAC proxy mode, PAC file URL, proxy authentication credentials, and allows proxy bypass on a Windows ARM64 machine.

msiexec /i PingIdDesktop_1.0.0.x.arm64.msi /quiet Port=30256 ProxyMode=2 ProxyAddress=http://10.1.1.1:8080/my.pac ProxyUsername=myusername ProxyPassword=mypassword ProxyBypass=1 /L*v installer.log

Use case 1: Silent install with custom port

Performs a silent installation, logs output, and sets the service listening port to 9411.

PingIdDesktop_1.0.0.x.exe /LOG=installer.log /VERYSILENT /SUPPRESSMSGBOXES /Port=9411

Use case 2: Install with manual proxy and custom timeout

Performs a silent installation, logs output, sets manual proxy mode, proxy address, and increases timeout to 45 seconds.

PingIdDesktop_1.0.0.x.exe /LOG=installer.log /VERYSILENT /SUPPRESSMSGBOXES /ProxyMode=0 /ProxyAddress=http://10.1.1.1:8080 /Timeout=45

Use case 3: Install with PAC proxy configuration

Performs a silent installation, logs output, sets PAC proxy mode, and specifies PAC file URL.

PingIdDesktop_1.0.0.x.exe /LOG=installer.log /VERYSILENT /SUPPRESSMSGBOXES /ProxyMode=2 /ProxyAddress=http://10.1.1.1:8080/my.pac

Use case 4: Full deployment (custom port, PAC proxy, proxy authentication, and proxy bypass)

Performs a silent installation, logs output, sets custom port, PAC proxy mode, PAC file URL, proxy authentication credentials, and allows proxy bypass.

PingIdDesktop_1.0.0.x.exe /LOG=installer.log /VERYSILENT /SUPPRESSMSGBOXES /Port=30256 /ProxyMode=2 /ProxyAddress=http://10.1.1.1:8080/my.pac /ProxyUsername=myusername /ProxyPassword=mypassword /ProxyBypass=1

Windows UI

This section explains how administrators can silently install and configure PingID desktop app using the UI on Windows.

In a PingOne environment, only an administrator can install the PingID desktop app on a user’s machine.

Before you begin

Installing the PingID desktop app requires:

  • At least 10.6 MB disc space.

  • Download the latest version of PingID desktop app.

Steps

  1. Download the latest version of PingID desktop app for Windows from the PingID downloads page.

  2. To launch the PingID desktop app installer, click the PingIdDesktop.exe file and then click Yes to allow the app to make changes to the device and then Next.

  3. Read the license agreement, select I accept the agreement.

    Result:

    The PingID Desktop Settings page shows the default Port number.

  4. (Optional) To configure a proxy, click Configure Proxy, edit the following fields and then click Apply:

    • Port: The service’s local listening port (default: 9410). Must match the Communication Port value defined in the PingOne admin console.

    • Proxy Mode: Select the connection method used for the desktop app to reach the PingID service:

      • Direct: Use a direct internet connection. This setting bypasses all OS-level and policy-defined proxy settings.

      • Manual: Requires explicit proxy server details.

      • PAC: Requires a Proxy Auto-Config (PAC) file URL.

      • Auto Detect: Uses the system-provided proxy settings (Web Proxy Auto-Discovery Protocol (WPAD), or Group Policy). User credentials are required if the proxy requires authentication.

    • Address: The full URI required by the chosen Proxy Mode (for example., http://proxy.corp.net:8080 for Manual, or https://wpad.corp/proxy.pac for PAC).

    • Username: Proxy account username, if authentication is enforced.

    • Password: Proxy account password, if authentication is enforced.

  5. Click Next. The installer shows the default install location.

    To install PingID in a different location, click Browse and navigate to the new location.

  6. Click Next and then Install.

    Result:

    The installation is complete. The user can now pair their device with PingID desktop app.

Mac CLI

About this task

This section guides administrators through performing a silent (non-interactive) installation and configuration of the PingID desktop app on macOS using the command line interface (CLI). The process uses the system’s installer utility, followed by the custom pingiddesktop configuration commands.

Before you begin

You must run all CLI commands with Administrator privileges.

Administrators can chain multiple commands together using the && operator. This ensures that each command runs only if the previous one succeeds.

Steps

  1. Download the PingID desktop app installer package (.pkg) from the PingID downloads page.

  2. Open a Terminal window and execute the full installation and configuration command block directly from the command line.

The most effective method for enterprise deployment is to place this command block within an MDM (Mobile Device Management) script or a provisioning tool. 
# Example: Full Enterprise Deployment (Install, Port, Proxy, Authentication, and Timeout)
sudo sh -c 'installer -pkg <PATH_TO_PKG> -target / && \
pingiddesktop update-port --port <PORT_NUMBER> && \
pingiddesktop proxy --mode <PROXY_MODE> --proxy-bypass <PROXY_BYPASS> --address <PROXY_URL> --username "<USERNAME>" --password "<PASSWORD>" && \
pingiddesktop timeout --time <SECONDS>'

Mac CLI parameter reference

The parameters used during the initial installation command block can also be used for ongoing maintenance. The pingiddesktop utility is a separate configuration program installed with the app, which administrators can use to adjust settings without needing to reinstall the entire application.

Subcommands

The utility uses the following subcommands to direct its actions.

Subcommand Purpose

update-port

Modifies the local listening port used by the desktop application service.

timeout

Configures the maximum duration the system waits for a biometric registration or authentication prompt response.

proxy

Configures network connectivity settings, including proxy address, mode, and authentication credentials.

logs

Gathers diagnostic data and system logs for troubleshooting. Learn more in Troubleshooting PingID desktop app.

macOS CLI Parameters

Append the following parameters to the installer executable to control silent execution and application features.

Parameter Valid values Description

-pkg <full_dirpath>

Fully qualified path (string)

Defines the full path to the PingIDDesktop.pkg installer file.

-target

string

Defines the target volume for the installation. The value must be / (the root volume), as only a standard, system-wide installation is supported.

--port

Number [1024 - 65535] (default: 9410)

Specifies the desktop app service’s local listening port. Must match the Communication Port value defined in the PingOne admin console.

--mode

Integer [0 - 3]

Defines the internet connection method.

Possible values:

  • 0 = Direct: Uses a direct internet connection. This setting bypasses any proxy settings defined by the operating system or policy.

  • 1 = Manual: Requires an explicit proxy URI (for example, http://proxy.example.com:8080, socks5://127.0.0.1:1080). Requires host and port.

  • 2 = PAC: Requires a Proxy Auto-Config (PAC) file URL (for example, https://wpad.corp.local/proxy.pac or file:///path/to/proxy.pac). Requires a valid PAC URL (http, https, or file).

  • 3 = Auto Detect: Uses system-provided settings (WPAD, Group Policy). User credentials are required if the proxy requires authentication.

--proxy-bypass

Integer [0, 1] (default: 0)

Defines whether users can bypass the enterprise proxy settings.

Possible values:

  • 0 (default): Deny. Prevents users from bypassing use of the enterprise proxy when using PingID desktop app. The proxy toggle doesn’t appear on the desktop app menu.

  • 1: Allow. Allows the user to use or bypass the desktop app proxy. The proxy bypass option displays on the desktop app menu.

--address

string

The full URI (Uniform Resource Identifier) for the proxy configuration. This value must include the protocol (for example, http://) and represents the required address based on the Proxy Mode used:

  • Manual Proxy Mode: The value represents the proxy server address and port. (for example, http://10.1.1.1:9410 or socks5://proxy.example.com:8080)

  • PAC Proxy Mode: The value represents the URL of the PAC file. (for example, https://wpad.corpnet/proxy.pac or file:///path/to/proxy.pac)

--username

string

Proxy account username (required if the proxy server enforces proxy authentication).

--password

string

Proxy account password (required if the proxy server enforces proxy authentication).

--time

integer [15 - 180] (default: 30)

Defines the maximum duration (in seconds) the system waits for a biometric prompt response. Used with the timeout subcommand. If the limit is reached, the operation (registration or authentication) is canceled.

Use cases

The following use cases demonstrate how to use the && operator to chain the primary installer command with the pingiddesktop configuration utility. These scenarios cover the most common enterprise deployment needs.

Use case 1: Standard install with custom port

Performs system-wide installation and sets the service listening port to 9090.

sudo sh -c 'installer -pkg /Users/jtan/Desktop/PingIDDesktop.pkg -target / && \
pingiddesktop update-port --port 9090'

Use case 2: Install with proxy configuration

Performs installation and sets a Manual Proxy (http://10.1.1.1:8080).

# The --proxy-bypass 0 setting enforces "Restrictive" mode, preventing the user from disabling the proxy.
sudo sh -c 'installer -pkg /Users/jtan/Desktop/PingIDDesktop.pkg -target / && \
pingiddesktop proxy --mode 0 --proxy-bypass 0 --address http://10.1.1.1:8080 --username "adminuser" --password "s3cret"'

Use case 3: Install with PAC proxy configuration

Performs installation and sets PAC proxy mode with a PAC file URL.

sudo sh -c 'installer -pkg /Users/jtan/Desktop/PingIDDesktop.pkg -target / && \
pingiddesktop proxy --mode 1 --proxy-bypass 0 --address https://wpad.corpnet/proxy.pac'

Use case 4: Install with timeout for biometric prompt

Performs a standard installation and configures the system to wait 45 seconds for a biometric prompt response before timing out.

sudo sh -c 'installer -pkg /Users/jtan/Desktop/PingIDDesktop.pkg -target / && \
pingiddesktop timeout --time 45'

Use case 5: Full deployment (port, proxy, authentication, and timeout)

A complete scenario combining port configuration, proxy settings, and biometric timeout in one command chain.

sudo sh -c 'installer -pkg /Users/jtan/Desktop/PingIDDesktop.pkg -target / && \
pingiddesktop update-port --port 9090 && \
pingiddesktop proxy --mode 0 --proxy-bypass 0 --address http://10.1.1.1:8080 --username "adminuser" --password "s3cret" && \
pingiddesktop timeout --time 45'

For details on using the logs subcommand to gather system data for troubleshooting purposes, refer to Troubleshooting PingID desktop app.

Mac UI

This section explains how administrators can silently install and configure PingID desktop app using the UI on macOS.

In a PingOne environment, only an administrator can install the PingID desktop app on a user’s machine.

Before you begin

Installing the PingID desktop app requires:

  • At least 10.6 MB disc space.

  • Download the latest version of PingID desktop app.

Steps

  1. Download the latest version of PingID desktop app for Mac from the PingID downloads page.

  2. To launch the PingID desktop app installer, click the PingID.pkg file and then click Allow and Continue.

  3. Read and Agree to the license agreement, and then click Continue.

  4. To start the installation, click Install and then enter your username and password.

    • By default, the PingID desktop app installs in the /Library/PingID Desktop/ folder. The installation location can’t be modified.

  5. Configure the following fields and then click Continue:

    • Port: The service’s local listening port (Default: 9410).

      This value must match the Communication Port value defined in the PingOne admin console.

    • Proxy Mode: Select the connection method used for the desktop app to reach the PingID service:

      • Direct: Bypasses all OS-level and policy-defined proxy settings.

      • Manual: Requires explicit proxy server details.

      • PAC: Requires a Proxy Auto-Config (PAC) file URL.

      • Auto Detect: Uses the system-provided proxy settings (Web Proxy Auto-Discovery Protocol (WPAD), or Group Policy).

    • Address: The full URI required by the chosen Proxy Mode (for example., http://proxy.corp.net:8080 for Manual, or https://wpad.corp/proxy.pac for PAC).

    • Username: Proxy account username, if authentication is enforced.

    • Password: Proxy account password, if authentication is enforced.

    Result:

    The installation is complete. The user can now pair their device with PingID desktop app.