Skip to main content

Ping Identity migration

Move from Ping Identity to Microsoft Entra ID with a migration path you can see

Ping Identity can describe materially different source architectures. Before any move is planned, PhaseArc establishes what you are actually running, because a PingOne tenant and a PingFederate deployment lead to very different migration work.

ConnectionsUsersFlowsOne migration path
Sources are inventoried separately, mapped to a single target design, then moved along one controlled path to Microsoft Entra ID.

What is a Ping to Entra migration?

A Ping Identity to Microsoft Entra ID migration moves application connections, user and group data, attributes and assignments, authentication flows, and provisioning integrations from a Ping deployment into Microsoft Entra ID, formerly called Azure Active Directory. Applications move in waves, the Ping environment keeps serving anything not yet cut over, and cutover follows validation rather than preceding it.

Discovery first

Know your Ping starting point

The single most common cause of an inaccurate Ping migration plan is assuming one architecture when the estate contains another, or both.

PingOne and PingFederate compared as migration starting points.
ConsiderationPingOnePingFederate
What it isA cloud identity platform delivered as a service.A federation server, commonly deployed and operated by the customer.
Where configuration livesIn the PingOne environment, exposed through the administrative console and APIs.In server configuration, exposed through the administrative console and administrative API.
Typical inventory routeEnvironment, applications, populations, groups, and policies.Adapters, connections, data stores, token processors, and mapped attribute contracts.
Common migration focusApplication connections, users and groups, attributes, and policy intent.Service provider connections, attribute contracts, and the federation cutover itself.
Frequent complicationCustom flows and integrations built around the platform.On-premises dependencies, custom adapters, and legacy application enforcement.

Where PingAccess, PingID, DaVinci, or other components appear, they are recorded during discovery as items with a dependency and an owner. Their target approach is agreed during assessment rather than assumed here.

Workstreams

What the migration actually covers

Each area has a different inventory source and a different definition of done.

Applications and connections

Service provider connections, client applications, and the metadata, endpoints, and certificates each one depends on.

Users and groups

Directory sources behind the Ping deployment, population or group structures, and how those translate into Microsoft Entra ID groups.

Assignments and attributes

Who can access what, plus the attribute contracts and claims that applications expect to receive after cutover.

Policies and authentication flows

Authentication policies, step-up requirements, and flow logic, translated by intent into Conditional Access and Entra authentication methods.

Provisioning

Outbound provisioning connections and directory synchronization, replaced with Microsoft Entra provisioning rather than moved as-is.

Custom integrations

Scripts, adapters, and API clients built against Ping, each needing an owner and a decision to rebuild, replace, or retire.

Protocol paths

SAML, OIDC, and everything that is neither

Modern protocols follow predictable target patterns. Legacy access models do not.

  • SAML connections become enterprise applications in Microsoft Entra ID, with entity identifiers, reply URLs, signing certificates, and claims that must be configured deliberately and confirmed with each service provider.
  • OIDC and OAuth clients are registered again in Microsoft Entra ID with new identifiers, redirect URIs, and credentials, so each one needs a coordinated switchover window.
  • Legacy or header-based applications, and anything protected by an agent or proxy enforcement model, require architecture-specific planning because Microsoft Entra ID enforces access differently.
  • Applications with hard-coded issuer values, embedded certificates, or bespoke assertion handling are treated as exceptions with named owners.

PhaseArc stages

How PhaseArc runs a Ping migration

The same four stages, applied to whichever Ping architecture discovery finds.

  1. 01

    Discover

    Inventory the source estate and its dependencies.

  2. 02

    Prepare

    Map objects to a target design, log exceptions, and plan waves.

  3. 03

    Migrate

    Run controlled batches while the source keeps serving sign-ins.

  4. 04

    Validate

    Test access and configuration, record evidence, decide on cutover.

Stage outputs for a Ping Identity to Microsoft Entra ID migration.
StageFocusConcrete output
DiscoverIdentify the architecture and inventory itA record of the Ping components in use, application connections, users and groups, attributes, and dependencies.
PrepareMapping and target designPer-object treatment, attribute and claim mapping, exception list, wave plan, and test plan.
MigrateControlled batchesExecuted wave changes with the Ping environment retained until approved cutover, plus a change record.
ValidateAccess, claims, provisioningValidation results per application, an exception log, and a documented cutover or fallback decision.

Scope caveats

Be honest about what is environment dependent

This is typical treatment, not a verified product support matrix. Scope for your environment is established during assessment.

Typical treatment and status by Ping object category.
Source itemTypical Entra destinationStatus
Users and attributesEntra ID users and directory attributesAssessed and mapped
Populations or groupsSecurity groups and dynamic membership rulesMapped or translated
SAML connectionsEnterprise applications with SAML SSOMapped or translated, validation required
OIDC and OAuth clientsApp registrations and enterprise applicationsRe-register, validation required
Attribute contracts and claimsClaims mapping on the target applicationTarget design required
Authentication policies and flowsConditional Access and authentication methodsTarget design required
Outbound provisioningMicrosoft Entra provisioningTarget design required
Agent or header-based enforcementApplication-specific target architectureEnvironment dependent
Custom adapters and integrationsRebuild, replace, or retireEnvironment dependent

Ping Identity migration questions

What is a Ping Identity to Microsoft Entra ID migration?
It is the project of moving application connections, users and groups, attributes and assignments, authentication flows, and provisioning integrations from a Ping Identity deployment into Microsoft Entra ID, then cutting over authentication once the destination has been validated.
Does Ping Identity mean one product?
No. Ping Identity describes a family of products. PingOne is a cloud identity platform, while PingFederate is a federation server usually deployed close to existing infrastructure. The two lead to materially different migration work, so discovery identifies the starting point first.
What about PingAccess, PingID, or DaVinci?
Treat them as components to identify during discovery. Where they are present, their role is documented and a target approach is agreed during assessment. PhaseArc does not claim product-specific migration support for these components on this page.
Can legacy or header-based applications migrate directly?
Not usually. Applications that rely on header-based access or agent-based enforcement need architecture-specific planning, because Microsoft Entra ID uses a different enforcement model. These applications are identified early and planned separately.
Do Ping policies map to Conditional Access?
Not one to one. Authentication policies and flows are translated by intent into Conditional Access and Microsoft Entra authentication method settings, then validated per application.

Establish your Ping starting point

An assessment identifies which Ping components are in play, inventories application connections and attributes, and sets the sequence for a migration you can validate.