Field Name Description
Region

Determines the PingOne API that the provisioning engine communicates with.

Select the region that appears on Settings > Environment > Properties in PingOne.
User Create

Selected (default) – PingFederate creates users in PingOne.

Cleared – PingFederate does not create users in PingOne.
User Update

Selected (default) – PingFederate updates existing users in PingOne.

Cleared – PingFederate does not update existing users in PingOne.
User Disable / Delete

Selected (default) – PingFederate disables or deletes users in PingOne.

Note: PingFederate can only re-enable a user if User Update is selected.

Cleared – PingFederate does not disable or delete users in PingOne.
Provision Disabled Users
This option applies when:
  • the User Create option is selected, and
  • the provisioning engine targets a user in the data store that has a "disabled" status.

Selected (default) – PingFederate creates the user in PingOne with a "disabled" status.

Cleared – PingFederate does not create the user in PingOne.
Note: If any of the above options are cleared, PingFederate logs a warning in the user workflow section of provisioner.log when the related action fails.
Remove User Action
This option applies when:
  • User Disable / Delete is selected, and
  • a previously-provisioned user no longer meets the condition set on the Source Location screen, or
  • a user has been disabled or deleted from the data store.

Disable (default) – PingFederate disables the user in PingOne.

Delete – PingFederate deletes the user from PingOne.
MFA User Device Management

If you are using the PingOne MFA service, this setting controls how PingFederate manages user devices.

Merge with devices in PingOne (default) – When a device is added in the data store, PingFederate adds it to the user's existing devices in PingOne. PingFederate does not remove any devices added in PingOne by other sources.

When an email or SMS device is updated in the datastore, and the value does not exist in PingOne, PingFederate adds it as a new device.
Note: PingOne accepts a maximum of five authentication methods per user by default. This maximum can be adjusted in the PingOne settings. If adding a new device hits this limit, PingFederate logs the "User Device Limit Exceeded" error. It does not try to add the device again until the user is updated.

Overwrite devices in PingOne – When a device is added or removed in the data store, PingFederate overwrites the user's devices in PingOne with those from the data store.

If a device in PingOne does not exist in the datastore, PingFederate removes it from PingOne.

If a device in the datastore does not exist in PingOne, PingFederate adds it in PingOne.
Default Authentication Method for New Users

Select a default authentication method to set when the connector provisions new users to PingOne

Note:

Users are prompted to authenticate using their default device. If the user has no mapped attribute value (or an invalid value) for the selected method, the primary device pairing is set to the next valid attribute in this order: Email 1, Email 2, Email 3, SMS 1, SMS 2, SMS 3, Voice 1, Voice 2, Voice 3. PingFederate attempts to provision all the user’s valid MFA devices which might result in the user not having the selected method as their default device.