If you have chosen to connect PingFederate to a directory server, the Provisioning tab becomes available.
On the Provisioning tab, you have the option to enable provisioning of users from your directory server to PingID. In this configuration, specify the group where PingFederate should look for member users and update PingID when their email address, first name, or last name has changed.
This provisioning capability is designed to manage existing PingID accounts. It does not create new PingID users. When PingFederate detects that a user has been removed from the specified group or disabled in the directory server, PingFederate sends an update to PingID to disable the PingID service for that account.