Ping Identity is a vendor of identity and access management (IAM) software and services. Its portfolio is sold as subscriptions: PingOne cloud services on a shared multi-tenant platform, single-tenant cloud offerings operated by Ping Identity, and self-managed software that customers install themselves. Ping Identity’s own licensing guide defines a licence as a contract-backed right to use specific products and features, in specific environments, up to an agreed amount of usage for a set period of time, and states that licences are typically sold as subscriptions.[3] This article is an overview; the deeper articles in this series cover each area.
Company and product history
Ping Identity Holding Corp. completed its acquisition by Thoma Bravo on 2022-10-18 in a transaction valued at approximately USD 2.8 billion.[15] ForgeRock announced on 2022-10-11 that it had agreed to be acquired by Thoma Bravo for USD 2.3 billion.[14] Thoma Bravo announced the completion of that acquisition on 2023-08-23 and stated that it had combined ForgeRock into Ping Identity.[16]
For licensing, the combination matters because two licensing vocabularies now coexist. Ping Identity’s page on the combination states that the ForgeRock Identity Cloud is being renamed PingOne Advanced Identity Cloud, and that customers of the cloud and of the ForgeRock Identity Platform software can consume PingOne services.[10] Ping Identity continues to publish the legacy ForgeRock agreements, among them the Subscription License Agreement, the Managed Services Provider Subscription Agreement, the Non-Production License Agreement and the Identity Cloud agreements, on a separate legal page.[11] The current Product Specific Terms add a clause for ForgeRock Subscription License Agreements dated before 1 January 2015, under which “Identity” has the same meaning as “User” or “Subscription user” in the older agreement.[2]
Product families and how they are sold
The licensing guide groups the portfolio into five areas.
| Family | Delivery | Typical unit of measure |
|---|---|---|
| PingOne multi-tenant SaaS (SSO, Directory, MFA and PingID, DaVinci, Protect, Verify, Authorize, Credentials, Recognize, Privilege) | Shared cloud platform | Annual Active User or Monthly Active User; transactions for some products |
| PingOne Advanced Identity Cloud | Single-tenant SaaS with Dev, Staging and Prod | Annual Active User (customer identity packages); Managed (Stored) Identity (workforce and B2B packages) |
| PingOne Advanced Services | Dedicated SaaS tenant for PingFederate, PingAccess, PingDirectory and PingCentral | Annual Active User, Monthly Active User or Annual Average Monthly Active User |
| Ping Government Identity Cloud | Single-tenant government cloud | Managed (Stored) Identity |
| Advanced Identity Software (PingAccess, PingAuthorize, PingCentral, PingDirectory, PingFederate, PingAM, PingDS, PingGateway, PingIDM) | Installed on premises or in the customer’s own cloud | Managed (Stored) Identity |
Sources for the table: the guide’s pages on PingOne multi-tenant SaaS,[4] PingOne Advanced Identity Cloud,[5] PingOne Advanced Services,[6] Ping Government Identity Cloud[7] and Advanced Identity Software.[8] Several products in the second and last rows are the former ForgeRock products, now named PingAM, PingDS, PingIDM and PingGateway in the guide.[8]
Contract framework
Ping Identity’s Subscription Agreement is the master document. It grants, during the subscription term on an Order Form, a limited, non-exclusive, non-sublicenseable and non-transferable right to access the hosted Service and a licence to install the Software in machine-readable form, in each case solely for the customer’s business use.[1] The agreement incorporates product-specific supplemental terms posted at a Ping Identity URL.[1] Those Product Specific Terms define identities, active identities and transactions, set fair-use limits for PingOne DaVinci and PingOne Protect, and fix a reinstatement fee for late renewals.[2] The Subscription Agreement lets Ping Identity amend terms located at URLs by posting them, and continued use is treated as consent.[1] Practitioners therefore need to archive the version of each linked document in force at signature and at each renewal. The subscription agreement and support terms article covers these terms in more detail.
Metrics
Ping Identity’s metric vocabulary is built on the identity.
- Annual Active User (AAU): a unique identity active at least once during a 365-day period starting at the licence start date, counted once per contract year.[4] See the catalog row Annual Active User.
- Monthly Active User (MAU): a unique identity active at least once in a given calendar month.[4] The Product Terms base Monthly Active Identity subscriptions on the annual average of monthly active identities.[2]
- Managed (Stored) Identity: a unique identifier for a user, device or other object stored and managed by the product, regardless of activity.[8]
- Transaction metrics: flow invocations for PingOne DaVinci, risk evaluations for PingOne Protect and verifications for PingOne Verify.[4]
- Identity types: the Product Terms distinguish Customer (External), Workforce (Internal), Corporate Affiliate (Business Partner or Partner) and Agent identities, and the Order Form lists the number and type licensed.[2]
Counting, limits and overage
For PingOne multi-tenant licences, identities, transactions and resources in all environments count fully against contracted limits.[4] Each licence has a soft limit on stored identities of usually 12 times the licensed MAU or AAU and a hard limit 10 percent above that, capped at 100M identities.[4] By contrast, the guide says that PingOne Advanced Identity Cloud has no hard limits that automatically shut off capabilities, and that production usage counts fully against the contract.[5]
Contractual overage rules are in the agreements, not in the product. Under the Subscription Agreement, fees are based on the scope purchased and not actual usage, and overage on a per-user, per-connection or other metric accrues at the then-current per-unit rate on the Order Form.[1] For Monthly Active Identities, the Product Terms set an overage fee of two times the annual per-unit rate and do not allow the purchased quantity to be decreased during the term.[2] For transaction entitlements, unused transactions expire without refund at the end of the subscription year, and excess transactions are billed at the base per-transaction rate with no discount.[2] The PingOne identity counting article works through these rules.
Cloud and self-managed deployment
Hosted services are licensed as access rights. Self-managed software is licensed by key or file, and licence expiry has different consequences by product. The self-managed software article covers PingFederate, PingAccess, PingDirectory, PingAuthorize and the legacy ForgeRock software contracts. The single-tenant clouds are covered in PingOne Advanced Identity Cloud and Advanced Services. On the Subscription Agreement, Ping Identity may audit, no more than once in any twelve-month period, the customer’s equipment on which the Software is installed, and an audit that finds underpayment leads to fees for the overuse and reimbursement of reasonable audit costs.[1]
Programs and commercial terms
Support is sold in four tiers (Base, Select, Premium, Elite); a customer without a Select, Premium or Elite subscription receives Base Support, and the Support Policy commits to a service availability of 99.99 percent.[12] Software versions follow a published lifecycle under which Long-Term Support versions have a guaranteed minimum of three years of Active Maintenance.[13] Subscriptions renew automatically for periods equal to the initial term unless either party gives written notice of non-renewal or reduction at least 90 days before term end, and Ping Identity may modify fees at renewal.[1] A renewal signed after expiry requires prorated fees, any renewal increase and a one-time late fee of 10 percent of the annual value.[2]
Ping Identity publishes starting prices for some PingOne packages: PingOne for Customers Essential from USD 35k per year and Plus from USD 50k per year, and PingOne for Workforce Essential at USD 3 and Plus at USD 6 per user per month, based on an annual contract with a 5,000 user minimum.[9] The page does not carry a date, and other products and bundles require contacting sales.
Out of scope
This article does not cover Ping Identity’s open source components, which the Subscription Agreement says remain subject to their own licences,[1] nor the PingID mobile application end-user licence, nor negotiated Order Form pricing. It also does not cover third-party services that interoperate with the products, for which Ping Identity states that its support obligations do not extend.[1]