Ping Product Corner: Faster Orchestration, Smoother Verification, Broader Protection

Identity is moving beyond one-time checks at login. Organizations need identity signals that can travel across the journey without adding friction.

Building on last month's Ping Product Corner, August brings a focused set of updates that connect Ping Identity’s universal services: identity verification, zero-knowledge biometrics, orchestration, and threat protection.

A pre-set email verification flow

PingOne DaVinci Actions provide pre-wired groups of nodes for common registration, authentication, and account-recovery patterns. Available on the PingOne Marketplace, builders can add reusable Actions to a new or existing flow, helping teams move from a blank canvas to a working experience with less rebuilding and more consistency. Visit the Ping documentation hub to learn more.

Auto-Enrollment on the Documentation Hub

Identity verification is one of the strongest ways to prove someone is who they say they are, but it can take time, so it should happen only once. After that, biometric authentication—such as a quick face check with PingOne Recognize—can confirm the same person in seconds. The challenge is connecting that quick check to the identity verified the first time, which traditionally requires a separate biometric enrollment.

Auto-enrollment in PingOne Verify solves both problems: after a successful verification, the verified selfie is automatically enrolled in PingOne Recognize, enabling faster future checks without asking the user to enroll again. Available in Early Access, the Verify policy controls connect identity proofing to future biometric authentication without a separate enrollment so teams can create smoother journeys while preserving a stronger foundation for trust.

Microblink is the technology in PingOne Verify that captures information from identity documents. With version 8.0, PingOne Verify can now support more document barcodes and handle certain documents more effectively The result is a more reliable document-capture experience across more verification use cases.

PingOne Recognize is now available through a new Singapore deployment, adding a lower-latency option for customers in the Asia-Pacific and Japan region. With PingOne Recognize’s privacy-preserving biometric authentication now available in the United States, Europe, Latin America, and APJ, organizations have more flexibility to align regional rollout and data-residency goals.

PingOne Protect’s User-Based Risk Behavior predictor now includes a new opt-in setting: Detect compromised user accounts. This update adds suspected account compromise to the predictor’s risk calculation, helping security teams identify potential account takeover earlier.

How the predictor works

The predictor compares each transaction with the user’s normal behavior. It learns from signals such as operating system, browser, activity time, country, application, and device characteristics. The model continuously updates its baseline and returns a dynamic Low, Medium, or High risk result.

The new setting can be enabled under Threat Protection > Predictors > User-Based Risk Behavior. See the configuration steps

How the response works

If the predictor identifies signs of compromise, the risk evaluation can return:

recommendedAction: ACCOUNT_RECOVERY

The policy or integration can then route the user into the organization’s account-recovery process. PingOne Protect can also combine predictor results and trigger MFA, CAPTCHA, password reset, selfie verification, denial, or a mitigation.

In practical terms:

• The user attempts authentication or another protected action.
• Protect compares the activity with the user’s established baseline.
• The predictor contributes its result to the wider risk policy.
• The policy or integration applies account recovery or another appropriate response.

August’s PingOne updates give administrators more control over how identity data is mapped, shared and provisioned.

1. PingOne Recognize connector: The PingOne Recognize connector is now available in early access, helping organizations add biometric enrollment and authentication to their existing PingOne workflows: The connector supports the following use cases:

   • Enroll a user with a live selfie
   • Enroll a user with an image
   • Authenticate a user with a live selfie
   • Disenroll a user
   • Check a user’s enrollment status
2. Microsoft Entra ID provisioning connection: PingOne can provision users between Microsoft Entra ID and PingOne in both directions. It can also provision groups and group membership from PingOne to Entra ID.
3. Microsoft Entra ID external group name mapping: Administrators can map Microsoft Entra ID attributes to PingOne’s External Group Names attribute. This lets PingOne use Microsoft group membership when controlling application access and provisioning external groups.
4. Attribute mapping for custom resource scopes: Administrators can map PingOne user attributes to scopes on a custom resource. Applications then receive the attributes linked to the scopes they request. This gives teams more control over what is included in access tokens.
5. PingOne provisioning connection: PingOne can provision users between two PingOne environments, including environments in the same organization. It can also provision supported native PingOne groups from the source environment to the target environment. This helps keep identity data aligned without recreating accounts manually.
6. HubSpot provisioning connection: PingOne can provision users between HubSpot and PingOne. The current documentation supports user creation, updates and removal, but not group provisioning.

PingOne Advanced Identity Cloud added customer-facing improvements across administration, scripting, authorization, and governance, including new activity and object-type views for unmanaged applications and the ability to send email from next-generation scripts. These updates help teams work with identity data more directly, improve operational visibility, and support more flexible governance workflows.

August’s updates reinforce a practical direction for identity: make trusted signals reusable, make common work easier to build, and extend protection across the places where people, devices, and applications interact.

Check back each month as Ping continues to expand what teams can build, secure, and scale, and share the updates most relevant to your customers and prospects.