Only one connection is needed per partner, even if integrating more than one web application.

While you define your entity ID on the Federation Info tab of the Protocol Settings window, you can identify your organization differently through the use of virtual server IDs on a per-connection basis. For more information, see Multiple virtual server IDs.

Additionally, you can deploy an SP connection to bridge a service provider to one or more identity providers through one or more authentication policy contracts. For more information, see Federation hub use cases and Federation hub and authentication policy contracts.
Note:

This topic applies to configuration settings needed for browser-based single sign-on (SSO). Although this information also applies to WS-Trust security token service (STS), if you are using PingFederate exclusively as an STS, start with WS-Trust STS configuration.