PingOne is Ping Identity’s multi-tenant cloud platform, in which customer environments run on shared infrastructure managed by Ping Identity.[1] By default a customer receives one or more environments, such as sandbox and production, and licences, identities and usage such as flows and risk evaluations are shown in the PingOne admin console.[1] This article explains the units of measure, the limits that the platform enforces and the ones that only the contract enforces, and the way licences attach to environments. It describes the position published in Ping Identity’s licensing guide, in the PingOne documentation and in the Product Specific Terms; the controlling document for any customer remains its Order Form.
Services and editions
The licensing guide lists the PingOne services that are licensed on an Annual Active User (AAU) or Monthly Active User (MAU) basis: PingOne Authorize, PingOne Credentials, PingOne DaVinci, PingOne Directory, PingOne MFA and PingID, PingOne Protect, PingOne Recognize and PingOne SSO.[1] Two services have a different treatment: PingOne Privilege and Enterprise Personal Agent Access state that MAU identity-based licensing is not applicable.[1] PingOne Verify uses identities and also a transaction-based unit of measure, the verification.[1] PingOne Platform Agent IAM Core is licensed by the number of human identities (customer, workforce or partner) on whose behalf AI agents act, rather than by agent or transaction volume.[1]
Solution bundles
Ping Identity packages several services as bundles, each with an Essential and a Plus level.[1]
| Bundle | Essential includes | Plus adds |
|---|---|---|
| PingOne for Customers (P14C) | PingOne SSO, PingOne Directory, DaVinci (with flow limits), PingDataSync | PingOne MFA, full DaVinci, API Access Management |
| PingOne for Workforce (P14W) | PingOne SSO, PingOne Directory, DaVinci (with flow limits), basic PingID MFA, PingDataSync | Full PingID MFA, full DaVinci |
| PingOne for B2B (P14B2B) | PingOne SSO, PingOne Directory, DaVinci (with flow limits), PingDataSync | PingOne MFA, full DaVinci, API Access Management |
The guide points to the fair-use policy in the Product Specific Terms for the Plus bundles.[1] A further bundle, PingOne for Customers Passwordless, includes PingOne Protect, SSO with Directory, MFA and DaVinci, is licensed by transactions based on flow invocations, and requires each product to be used only through DaVinci flows.[1]
Ping Identity’s platform pricing page shows starting prices for some of these packages: PingOne for Customers Essential from USD 35k annually and Plus from USD 50k annually, and PingOne for Workforce Essential at USD 3 and Plus at USD 6 per user per month, based on an annual contract with a 5,000 user minimum.[9] The page carries no date. The catalog records these as list prices of the corresponding SKUs, for example PingOne for Workforce Plus.
The identity metrics
Annual Active User
An Annual Active User is a unique identity that is active at least once during a 365-day period starting at the licence start date.[1] Active means at least one qualifying identity operation during the year, such as sign-on or authentication, token issuance, validation or refresh, password set or change, or other operations covered by the Product Terms; each identity counts once per contract year regardless of how often it authenticates.[1] The Product Terms define an Annual Active Identity as one that is active at least once in a twelve-month period, and an Active Identity as one that accesses the service for identity operations, including self-service registration, sign-in, authentication, token refresh or password change.[2] See the catalog row Annual Active User.
Monthly Active User
A Monthly Active User is a unique identity that is active at least once in a given calendar month.[1] The contractual rule is more specific. Where an Order Form specifies Monthly Active Identities, the entitlement is measured as the annual average of monthly active identities for each year of the subscription: the average of the monthly totals for each calendar month of each annual term, with partial months at the start and end of the subscription disregarded and months that overlap two annual terms counted in the later term.[2] The customer is not charged for repeated use of a product by the same identity in that month.[2] If the average exceeds the entitlement, the Product Terms provide an overage fee of two times the annual per-unit rate on the Order Form for the overage in that annual term, and the quantity purchased cannot be decreased during the Order Form term.[2] The licensing guide calls the same calculation Annual Average Monthly Active User (AAMAU) in its description of PingOne Advanced Services.[1]
Identity types
The Product Terms classify each identity as a Customer (or External) identity, a Workforce (or Internal) identity for employees, contractors and subcontractors, a Corporate Affiliate (Business Partner or Partner) identity for people employed by an entity engaging with the customer, or an Agent identity for a non-human actor powered by language models.[2] The Order Form lists the number and type of identities per annual period, and in some cases the Agent entitlements attached to an aggregated pool of identities.[2] The identity type controls the fair-use limits that follow.
Limits: soft, hard and contractual
Each PingOne licence carries a soft limit and a hard limit on stored identities. The soft limit is usually 12 times the licensed MAU or AAU, and the hard limit is 10 percent above the soft limit, capped at 100M identities, whichever is lower.[1] User limits are based on the total number of identities across all environments assigned to a licence.[3] The PingOne documentation works an example: a licensed MAU of one million gives a soft limit of 12 million and a hard limit of 13.2 million; at 10.8 million, 90 percent of the soft limit, the console shows a warning; at 12 million another warning appears but users can still be added; at 13.2 million the console states that no more users can be added until the licence is upgraded.[3] Administrators can configure alerts for approaching, reached and exceeded limits.[3]
These limits cap the stored population. They do not replace the active-user measure in the contract. A tenant with 12 times its licensed MAU stored is technically within the soft limit, while the number of identities that were active in a month or year is what the Order Form meters and what the overage rule addresses. Practitioners reviewing a position should record both figures: stored identities against the soft and hard limits, and active identities against the contracted AAU or MAU, including the other environments that share the licence, because identities, transactions and resources in all environments count fully against contracted limits.[1] The guide also states a platform cap of 500 environments per organization.[1]
Transaction-based units
Flow invocations (PingOne DaVinci)
DaVinci can be sold identity-based (AAU or MAU) or transaction-based through flows.[1] A flow is an executed DaVinci flow run triggered at the start of a journey, such as a registration, passwordless login, password recovery, device registration or adaptive authentication journey.[1] A flow invocation occurs each time a flow is initiated; subflows launched by a flow are not additional invocations.[1] The flow-based licence has a fair-use limit of 80 connector executions per flow, and the documentation notes that the dashboard and licence represent an invocation as a flow execution.[3] Usage against the entitlement is the total of the per-environment metrics.[3]
Identity-based DaVinci SKUs have a fair-use limit expressed as an average number of flow invocations per day per identity: 1 per Customer Identity, 4 per Partner Identity and 8 per Workforce Identity.[2] The catalog holds this as the rule PingOne DaVinci identity-based fair use.
Risk evaluations (PingOne Protect)
A risk evaluation is a risk assessment event triggered by a business operation such as sign-on, registration, password recovery or any other call to the risk engine; each qualifying call typically counts as one.[1] PingOne Protect can be sold identity-based or transaction-based, with a fair-use allowance of risk evaluations per identity per year by identity type and usage tier.[1] The Product Terms set the averages.[2]
| Identity type | Low | Standard | High |
|---|---|---|---|
| Customer | 12 per year | 52 per year | 365 per year |
| Partner | 260 per year | 1040 per year | 2080 per year |
| Workforce | 365 per year | 1460 per year | 2920 per year |
Verifications (PingOne Verify)
Verifications count identity verification checks, including document plus selfie verification, liveness checks, ID document lookups and, where applicable, utility bill or credit report checks.[1] The guide lists the verification services, among them Universal Capture, Automated ID Inspection, Face Verification, Manual ID Inspection, a Manual ID Inspection Step Up and a Government ID System of Record Check, and says that the last two require the purchase of Automated ID Inspection.[1] The system-of-record check is stated not to be eligible for any uptime availability commitment.[1]
General transaction entitlements
For products that Ping Identity entitles by number of transactions, the Product Terms define a transaction as any identity-related operation, such as ID verification, sign-up, sign-in, authentication, token refresh or password change.[2] Renewable transactions set a maximum per subscription term, and non-recurring transactions increase the maximum only for the subscription year of purchase.[2] Transactions that are not used in the permitted subscription year expire without refund.[2] If the customer uses the whole entitlement before year end, Ping Identity may stop processing further transactions until payment for the excess is assured, and excess transactions are charged at the base per-transaction fee with no discount.[2]
Licence records, environments and expiry
PingOne licences are records on the Licenses page of the admin console, which shows the organization, the admin licence, and active, future and expired licences.[8] The platform operates on the principle of one licence per environment, so a licence must include every product to be used together in that environment.[7] A licence can be associated with many environments, but an environment with only one licence.[6] The FAQ gives a practical consequence: a customer with a PingOne MFA licence who buys PingOne Protect needs its MFA licence upgraded to an MFA-Protect licence, because a new Protect-only licence cannot be added to the same environment.[4] Licences also limit the number of environments to which they may be assigned.[4]
The standard licence types are ADMIN (administration of the admin console), TRIAL (evaluation of all PingOne services for 30 days), SOLUTION (no PingOne services, enabling an environment for non-PingOne products), JIT_TRIAL (generated when a customer with paid licences adds trial services to a new environment), packages named for each paid service, and combo licences containing several services.[5] PingID licences are managed separately: a PingID tenant created from PingOne remains in trial status until explicitly upgraded.[4]
Expiry behaves differently for trial and paid licences. When a trial licence expires, access to the environment is disabled; when a paid licence expires, administrators retain access but configuration changes are paused, while end-user functionality continues.[4] Renewal timing is contractual: the Subscription Agreement renews Order Forms automatically unless notice is given at least 90 days before term end,[10] and the Product Terms add a reinstatement fee for a renewal signed late.[2]
SMS and voice charges
PingOne MFA can use optional SMS and voice notifications provided through third parties. The Product Terms make the customer responsible for the third-party charges and reasonable overhead expenses, billed in arrears unless prepaid.[2] The Subscription Agreement adds that for purchases through a marketplace, variable fees such as SMS may be remitted directly to Ping Identity where invoicing through the marketplace is not reasonable.[10]
Out of scope
This article does not cover the PingOne Advanced Identity Cloud and PingOne Advanced Services single-tenant offerings, the Ping Government Identity Cloud, or the self-managed software, which have separate articles, nor the end-user terms of the PingID mobile application. It does not state negotiated prices.