For outbound provisioning, identities flow from PingOne to an external identity store. PingOne is the source and the external identity store is the target.

For inbound provisioning, identities flow from an external identity store to PingOne. The external identity store is the source and PingOne is the target. Users are retrieved from the source identity store using a polling mechanism.

For inbound provisioning, the polling mechanism checks the source identity store every 4 hours. This value is not configurable. You can also use the PingOne API to set up inbound SCIM for user provisioning. For more information, see SCIM in the PingOne API Reference.

After five consecutive polling failures, the polling mechanism will time out with a warning. At this point, you can check your configuration and try again. The timeout expires after 12 hours, at which time the polling mechanism will attempt to run a full re-sync for the associated provisioning rule.

Note:

PingOne must be either the source or target identity store.

The following table shows the inbound and outbound capabilities for each connection type.

Identity store

Inbound

Outbound

SCIM

Yes

Note:

Users are retrieved from the source identity store using a polling mechanism. You can also use the PingOne API to set up inbound SCIM for user provisioning. For more information, see SCIM in the PingOne API Reference.

Yes

Salesforce

Yes

Salesforce Communities

Yes

Salesforce Leads and Contacts

Yes

Aquera

Yes

Workday

Yes

Note:

Users are retrieved from the source identity store using a polling mechanism.

Yes

Microsoft Azure (Office 365)

Yes

Zoom

Yes

Slack

Yes

ServiceNow

Yes

Google Workspace

Yes

LDAP Gateway

Yes