PingOne Privilege

Requiring PingID MFA for PingOne Privilege app connections

PingOne Privilege integrates with PingID multi-factor authentication (MFA), so users can authenticate with the MFA method their organization already uses. When you enable this integration, PingOne Privilege challenges users with PingID MFA when they connect the PingOne Privilege app to the gateway.

This topic applies to Endpoint Controller-based deployment models. Learn more in Choosing a deployment model.

How PingID MFA works with the PingOne Privilege app

In Endpoint Controller-based deployments, users connect the PingOne Privilege app to the gateway to reach their resources. When you require PingID MFA, PingOne Privilege issues a challenge before privileged actions such as sign-on or mid-session step-up authentication:

  1. The user launches the PingOne Privilege app and clicks Connect.

  2. If the PingID MFA policy applies, the user receives an MFA challenge.

  3. The user can then select from a dropdown of available MFA methods.

  4. The user approves the challenge in the PingID mobile app or the PingID desktop app.

  5. When the challenge succeeds, the app connects to the gateway and the user can request access to their resources through the console.

After the app connects, the user can also launch the admin or user console through the Endpoint Controller. When the PingID MFA policy applies, launching the console includes the same MFA challenge.

Users who already use PingID across their PingOne environment sign on with the MFA method they know, without a separate credential for PingOne Privilege. After the app connects, users open the user console through the Endpoint Controller. Learn more in Accessing the user console.

Supported PingID MFA methods

Both PingID applications work with this integration:

  • PingID mobile app: users approve a push notification or enter a one-time passcode (OTP).

  • PingID desktop app: users approve the challenge from their desktop application.

Requiring PingID MFA for app connections

Before you begin

  • Your organization uses PingID MFA in PingOne. Learn how to configure PingID in the PingOne documentation.

  • Users have installed the Endpoint Controller and onboarded their devices. Learn more in Onboarding users.

Steps

You enable PingID MFA for PingOne Privilege app connections as a policy option in PingOne.

  1. In the PingOne admin console, go to the MFA policy settings for PingOne Privilege.

  2. Select the option to require MFA when users connect the PingOne Privilege app to the gateway.

  3. Select from the list the PingID authentication methods that users can use to approve the challenge.

  4. Define the users or groups the policy will apply to.

  5. Save the policy.

The next time a user connects the PingOne Privilege app, PingOne Privilege challenges the user with PingID MFA before the connection completes.

In No Endpoint Controller-based deployments, single sign-on (SSO) to the admin and user consoles already supports PingID MFA through PingOne. No additional configuration is required. Learn more in Tenant settings.