---
title: Requiring PingID MFA for PingOne Privilege app connections
description: Require PingID multi-factor authentication (MFA) when users connect the PingOne Privilege app to the gateway in Endpoint Controller-based deployments.
component: privilege
page_id: privilege:agent-privilege:configuration/pingid-mfa-app-connect
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/pingid-mfa-app-connect.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: September 10, 2026
section_ids:
  how-pingid-mfa-works-with-the-pingone-privilege-app: How PingID MFA works with the PingOne Privilege app
  supported-pingid-mfa-methods: Supported PingID MFA methods
  requiring-pingid-mfa-for-app-connections: Requiring PingID MFA for app connections
  before-you-begin: Before you begin
  steps: Steps
---

# Requiring PingID MFA for PingOne Privilege app connections

PingOne Privilege integrates with PingID multi-factor authentication (MFA) *(tooltip: \<div class="paragraph">
\<p>An electronic authentication method where a user is granted access only after presenting two or more verification factors for authentication.\</p>
\</div>)*, so users can authenticate with the MFA method their organization already uses. When you enable this integration, PingOne Privilege challenges users with PingID MFA when they connect the PingOne Privilege app to the gateway.

This topic applies to Endpoint Controller-based deployment models. Learn more in [Choosing a deployment model](../../getting-started/choosing-deployment-model.html).

## How PingID MFA works with the PingOne Privilege app

In Endpoint Controller-based deployments, users connect the PingOne Privilege app to the gateway to reach their resources. When you require PingID MFA, PingOne Privilege issues a challenge before privileged actions such as sign-on or mid-session step-up authentication:

1. The user launches the PingOne Privilege app and clicks **Connect**.

2. If the PingID MFA policy applies, the user receives an MFA challenge.

3. The user can then select from a dropdown of available MFA methods.

4. The user approves the challenge in the PingID mobile app or the PingID desktop app.

5. When the challenge succeeds, the app connects to the gateway and the user can request access to their resources through the console.

After the app connects, the user can also launch the admin or user console through the Endpoint Controller. When the PingID MFA policy applies, launching the console includes the same MFA challenge.

Users who already use PingID across their PingOne environment sign on with the MFA method they know, without a separate credential for PingOne Privilege. After the app connects, users open the user console through the Endpoint Controller. Learn more in [Accessing the user console](../../human-privilege/getting-started-users/accessing-user-console.html).

## Supported PingID MFA methods

Both PingID applications work with this integration:

* PingID mobile app: users approve a push notification or enter a one-time passcode (OTP) *(tooltip: \<div class="paragraph">
  \<p>A passcode valid for only one sign-on or transaction on a computer system or other digital device. Also known as a one-time password, one-time PIN, or dynamic password.\</p>
  \</div>)*.

* PingID desktop app: users approve the challenge from their desktop application.

## Requiring PingID MFA for app connections

### Before you begin

* Your organization uses PingID MFA in PingOne. Learn how to configure PingID in the PingOne documentation.

* Users have installed the Endpoint Controller and onboarded their devices. Learn more in [Onboarding users](../../getting-started/onboarding-users.html).

### Steps

You enable PingID MFA for PingOne Privilege app connections as a policy option in PingOne.

1. In the PingOne admin console, go to the MFA policy settings for PingOne Privilege.

2. Select the option to require MFA when users connect the PingOne Privilege app to the gateway.

3. Select from the list the PingID authentication methods that users can use to approve the challenge.

4. Define the users or groups the policy will apply to.

5. Save the policy.

The next time a user connects the PingOne Privilege app, PingOne Privilege challenges the user with PingID MFA before the connection completes.

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | In No Endpoint Controller-based deployments, single sign-on (SSO) *(tooltip: \<div class="paragraph">&#xA;\<p>The process of authenticating an identity (signing on) at one website (usually with a user ID and password) and then accessing resources secured by other domains without reauthenticating.\</p>&#xA;\</div>)* to the admin and user consoles already supports PingID MFA through PingOne. No additional configuration is required. Learn more in [Tenant settings](../../human-privilege/getting-started-admin/tenant-settings.html). |