Ping Identity

No entries match these filters. Clear filters

1. changelog Oct 29, 2026 · issue 124

   Ping Identity adds a remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI-agent access, QR code callbacks in scripted nodes, and multi-alias SAML IdPSAML IdPA SAML Identity Provider is a service that authenticates users and issues signed XML assertions to relying applications, letting a single login session span many services without re-entering credentials. import⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Ping Identity adds the AIC Remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., an opt-in, centrally hosted HTTP-based Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server that lets AI agents and development assistants administer Advanced Identity Cloud via natural-language prompts over OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authentication — available now in sandbox environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Ping Identity adds a callbacksBuilder.qrCodeCallback() binding for scripted nodes, letting them generate QR codes that render in hosted pages or apps built with the Ping SDKs.
   • Ping Identity now lets you import multiple remote identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. sharing the same entity ID by specifying an alias, with uniqueness enforced per circle of trust — aliased providers do not support single logout or Enhanced Client or Proxy (ECP), and hosted service-provider assertion consumer service URLs require a manual cot parameter.
   • Custom WS-Fed applications now support user-defined name formats for service provider attributes, letting you specify custom namespaces to meet the attribute requirements of specific relying parties.
   • The OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. discovery endpoint now always returns authorization_response_iss_parameter_supported: true, and authorization responses (including error responses) now include the iss parameter so clients can verify the response issuer.

   +5 more show less

   • Identity Governance now accepts workflow definitions up to 1 MiB.
   • Managed object enum-typed properties are now matched and rewritten without regard to case, normalizing submitted values to the exact case defined in the schema.
   • Reports have been improved: several parameters in built-in reports are now optional, allowing reports to run with broader criteria, and in custom reports the Completed By field in the Entitlement Review Item entity now returns the userName value.
   • The underlying datastore now enforces unique usernames and application names.
   • Delegated administrators can now view their own relationship properties in the hosted account pages.
   • Ping Identity adds the AIC Remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., an opt-in, centrally hosted HTTP-based Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server that lets AI agents and development assistants administer Advanced Identity Cloud via natural-language prompts over OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authentication — available now in sandbox environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Ping Identity adds a callbacksBuilder.qrCodeCallback() binding for scripted nodes, letting them generate QR codes that render in hosted pages or apps built with the Ping SDKs.
   • Ping Identity now lets you import multiple remote identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. sharing the same entity ID by specifying an alias, with uniqueness enforced per circle of trust — aliased providers do not support single logout or Enhanced Client or Proxy (ECP), and hosted service-provider assertion consumer service URLs require a manual cot parameter.

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Managed object enum values are now normalized to schema-defined case on write — scripts or dashboards that compare accountStatus or other enum property values against non-canonical cases (e.g. Active instead of active) must be updated to expect the exact case defined in the schema.
2. 22 Oct 2026 (2026-10-23) Oct 23, 2026 · issue 119

   Ping Identity AIC adds QR-code scripted nodes, multi-provider SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. import by alias, and case-normalized managed object enums.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Generate a QR code inside a scripted authentication node to display to users in the admin console.
   copy

   $ callbacksBuilder.qrCodeCallback()

   • Adds callbacksBuilder.qrCodeCallback() binding to scripted nodes, enabling QR codes to render in the Advanced Identity Cloud admin console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds support for importing multiple remote identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. sharing the same entity ID by specifying an alias; uniqueness is enforced per circle of trust.
   • Enables omission of the scope parameter in authorization code requests (including PAR) when authorization_detailsauthorization_detailsA structured JSON field defined in RFC 9396 (OAuth 2.0 Rich Authorization Requests) that lets a client declare fine-grained permissions beyond simple scopes, giving cyber tools precise access control in OAuth flows. are requested and Rich Authorization Requests with RCSRCSRich Communication Services, a messaging protocol standard maintained by the GSMA that replaces SMS with richer features like read receipts, file transfer, and group chat over carrier or IP networks. is enabled.
   • The OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. discovery endpoint now always returns authorization_response_iss_parameter_supported: true, and authorization responses (including error responses) that redirect to the client now include the iss parameter, enabling issuer verification.
   • Custom WS-Fed applications now support user-defined name formats for service provider attributes, allowing custom namespaces for relying party compatibility.

   +3 more show less

   • Custom reports: the Completed By field in the Entitlement Review Item entity now returns the userName value, and several parameters in built-in reports are now optional, allowing reports to be run with broader criteria.
   • The underlying datastore now enforces unique usernames and application names.
   • Version 2 of the Certificate Collector and Certificate Validation nodes includes security hardening improvements.
   • Adds callbacksBuilder.qrCodeCallback() binding to scripted nodes, enabling QR codes to render in the Advanced Identity Cloud admin console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds support for importing multiple remote identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. sharing the same entity ID by specifying an alias; uniqueness is enforced per circle of trust.

   6 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Managed object enum values are now rewritten to the exact schema-defined case on create, update, or patch (e.g. Active becomes active if the schema defines active). Scripts or dashboards that compare enum property values using non-schema case will need to be updated to expect the schema-defined case.
3. docs update Oct 22, 2026 · issue 116

   PingOne adds session token cookie persistence control and module-based authorization resource grouping in Authorize⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Switch a shared kiosk environment to non-persistent ST cookies so sessions are cleared when the browser closes, preventing credential leakage between users.
   📍In the PingOne console, go to your environment › Settings › Authentication Settings, then set the session token cookie to non-persistent.
   Organise authorization resources by application team in PingOne Authorize by creating a module so each team can self-manage their policies independently.
   📍In the PingOne console, go to Authorize › Modules, create a new module for your application team, and assign the relevant authorization resources to it.
   • Adds per-environment control over whether PingOne uses a persistent or non-persistent session token (ST) cookie, configurable in Authentication Settings — non-persistent cookies are discarded on browser close, useful for kiosk and shared workstation deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces modules in PingOne Authorize to group authorization resources by application team, enabling teams to manage their own module contents while administrators retain centralized governance.
   • PingOne Forms now renders JSON-formatted values in dynamic text as plain text on end-user forms, enabling use of JSON outputs in flow development nodes.
   • Adds per-environment control over whether PingOne uses a persistent or non-persistent session token (ST) cookie, configurable in Authentication Settings — non-persistent cookies are discarded on browser close, useful for kiosk and shared workstation deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces modules in PingOne Authorize to group authorization resources by application team, enabling teams to manage their own module contents while administrators retain centralized governance.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Authorization resources created before the modules feature are automatically migrated to the Default module and cannot be moved to other modules.
4. docs update Oct 22, 2026 · issue 116
   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Configure non-persistent ST cookies for a kiosk environment so sessions are discarded when the browser closes.
   📍In the PingOne console, go to your Environment › Authentication Settings, then under Session token cookie persistence select Non-persistent.
   Organize authorization resources by team in PingOne Authorize by creating a module and assigning relevant resources to it.
   📍In the PingOne console, go to Authorize › Modules, create a new module for your application team, then add the team's authorization resources to that module.
5. 20 Oct 2026 (2026-10-21) Oct 21, 2026 · issue 116

   Ping Identity launches an opt-in Remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. in sandbox, letting AI agents administer Advanced Identity Cloud via natural-language prompts over OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Exposes tenant-scoped MCP tools covering journey and script configuration, application and identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. management, user administration, policy settings, and audit log analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

6. changelog Oct 20, 2026 · issue 114

   Ping Identity adds multi-value node properties, telephone user fields, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments./SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. email config, navigation profiles, and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata import controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Tailor the hosted account portal menu so that, for example, admin-tier users see account management links that standard users do not.
   📍In the admin console, go to Hosted Pages › Navigation Profiles, create a new profile, assign it to the target user group, and configure the menu items to expose.
   Route outbound identity emails through Microsoft Entra ID or a custom SMTP server and verify delivery with a test email before going live.
   📍In the Advanced Identity Cloud admin console, go to Email Provider settings, select Microsoft Entra ID or Custom SMTP, fill in the connection details, then click Send Test Email to confirm.
   • Adds support for skipping XML signature verification when importing remote SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. provider metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds telephone number as a user property format with optional server-side validation, providing separate country code and phone number fields in hosted pages and the admin console.
   • Adds ability to configure Microsoft Entra ID or custom SMTP email providers and send test emails from the Advanced Identity Cloud admin console.
   • Adds customizable hosted account pages navigation menu via navigation profiles, enabling different menus for different groups of users.
   • Adds multi-value selection from predefined options when configuring custom node properties in the node designer.

   +3 more show less

   • Makes the next-generation scripting engine the default when creating scripts in the Advanced Identity Cloud admin console.
   • Adds search and sort capabilities for the list of AI agent identities.
   • Improves journey canvas interactions by adding the ability to select multiple journey nodes by holding Shift and clicking each node, and to pan the canvas by holding the space bar and dragging with the left mouse button.
   • Adds support for skipping XML signature verification when importing remote SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. provider metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds telephone number as a user property format with optional server-side validation, providing separate country code and phone number fields in hosted pages and the admin console.
   • Adds ability to configure Microsoft Entra ID or custom SMTP email providers and send test emails from the Advanced Identity Cloud admin console.
   • Adds customizable hosted account pages navigation menu via navigation profiles, enabling different menus for different groups of users.

   4 more in Everything

7. 15 Oct 2026 (2026-10-15) Oct 15, 2026 · issue 110

   Advanced Reporting gains optional parameters and human-readable usernames in entitlement review items.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • In Advanced Reporting, parameters such as status, journeys, and roles are now optional in several out-of-the-box reports, so you can run them without selecting values you don't need.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • In Advanced Reporting, the Completed By field in entitlement review items now returns usernames instead of GUIDs.
   • In Advanced Reporting, parameters such as status, journeys, and roles are now optional in several out-of-the-box reports, so you can run them without selecting values you don't need.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Completed By field in entitlement review items now returns usernames instead of GUIDs — saved reports or integrations that expect GUIDs must be updated.
8. docs update Oct 10, 2026 · issue 100

   DaVinci MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Use Case Connector gains PingID Workforce auth capabilities including YubiKey, PingID Desktop, OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. token resync, and backup authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable backup authentication so users without their MFA device can authenticate via a directory email or phone number.
   📍In the DaVinci flow editor, open the MFA Use Case Connector node › Check Authentication Policy capability › enable Back Up Authentication › wire the one-time device contact details (email or phone) into the input fields, then connect the backup outcome path to the next step.
   Activate OATH hardware token resync so users with time-drifted tokens can re-sync during device activation and handle the extra OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. prompt.
   📍In the DaVinci flow editor, open the MFA Use Case Connector node › Finish Device Registration capability › enable the OATH Token Resync toggle › add an outcome branch for the extraOtpRequired error to prompt the user for the additional verification code.
   Migrate the DaVinci widget embed to the new v2 URL to benefit from reduced flow loading times before the October 26 production rollout.
   copy

   $ Replace your existing widget script tag:
   <script src="https://assets.pingone.<region>/davinci/latest/v2/davinci.js"></script>
   or, to exclude DaVinci CSS rules:
   <script src="https://assets.pingone.<region>/davinci/latest/v2/davinci-no-css.js"></script>

   • Adds extraOtpRequired error output to the Finish Device Registration capability's new OATH Token Resync toggle, prompting users for an additional verification code during time-drift resync of OATH hardware tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Update Device Nickname capability to the MFA Use Case Connector, enabling device renaming after registration when allowed by MFA policy.
   • Adds YubiKey support to the MFA Use Case Connector with a dedicated device type for registration and dedicated outcome paths for authentication.
   • Adds PingID Desktop as a device type in the MFA Use Case Connector for registration and passwordless authentication, with its own output paths and outcomes.
   • Adds Back Up Authentication option to the Check Authentication Policy capability, letting users authenticate via a one-time email or phone contact when their MFA device is lost.

   +2 more show less

   • Adds Remember Me support to the MFA Use Case Connector, allowing users who pass Check Authentication Policy and Finish Device Authentication to skip re-authentication on the same device.
   • Publishes a new streamlined widget at https://assets.pingone.<region>/davinci/latest/v2/davinci.js (and davinci-no-css.js variant) to reduce flow loading times.
   • Adds extraOtpRequired error output to the Finish Device Registration capability's new OATH Token Resync toggle, prompting users for an additional verification code during time-drift resync of OATH hardware tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Update Device Nickname capability to the MFA Use Case Connector, enabling device renaming after registration when allowed by MFA policy.
   • Adds YubiKey support to the MFA Use Case Connector with a dedicated device type for registration and dedicated outcome paths for authentication.
   • Adds PingID Desktop as a device type in the MFA Use Case Connector for registration and passwordless authentication, with its own output paths and outcomes.
   • Adds Back Up Authentication option to the Check Authentication Policy capability, letting users authenticate via a one-time email or phone contact when their MFA device is lost.

   +1 more show less

   • Publishes a new streamlined widget at https://assets.pingone.<region>/davinci/latest/v2/davinci.js (and davinci-no-css.js variant) to reduce flow loading times.

   1 more in Everything

9. docs update Oct 9, 2026 · issue 098
   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable time-drift resync for a user activating an OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. hardware token so the token is accepted even when slightly out of sync.
   📍In the DaVinci flow editor, open the MFA Use Case Connector node › select the Finish Device Registration capability › toggle OATH Token Resync to on. Handle the extraOtpRequired error output path to prompt the user for the additional verification code before completing registration.
   Let users recover MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. access from a one-time backup device (email or phone) when their primary MFA device is unavailable.
   📍In the DaVinci flow editor, open the MFA Use Case Connector node › select the Check Authentication Policy capability › enable Back Up Authentication › wire in the user's directory email or phone number as the one-time device contact details.
10. docs update Oct 8, 2026 · issue 097

    Ping Identity: Adds support for Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. hybrid join in North America, enabling PingOne to issue security tokens for the hybrid join process.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    After a successful PingOne Verify transaction, automatically enroll the user's verified selfie into PingOne Recognize — eliminating a separate enrollment step for facial recognition.
    📍In PingOne, go to Verify › Policies, select your policy, and enable Auto-enrollment in PingOne Recognize under the verification settings.
11. docs update Oct 8, 2026 · issue 097

    MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Use Case Connector gains OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. Token Resync, Update Device Nickname, backup authentication, and Remember Me via PingID Workforce capabilities.

    • Adds extraOtpRequired error output to the Finish Device Registration capability's new OATH Token Resync toggle, prompting users for an additional verification code when time-drift resync is needed during OATH hardware token activation.
    • New integrationAdds Update Device Nickname capability to the MFA Use Case Connector, allowing device nickname updates after registration when renaming is permitted by the MFA policy.
    • Adds Back Up Authentication option to the Check Authentication Policy capability, enabling users without their MFA device to authenticate via a one-time device (email or phone from the org directory).
    • Adds Remember me support to the MFA Use Case Connector via Check Authentication Policy and Finish Device Authentication capabilities, allowing users to skip authentication on trusted devices by passing the Signals SDK payload.

    4 details in Everything

12. docs update Oct 6, 2026 · issue 096

    PingOne gains Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. hybrid join support in all geographies and a new default 2-minute MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. lock duration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Extends Microsoft Entra ID hybrid join support to all geographies (previously US/North America only), enabling hybrid-joined Windows devices to obtain and renew primary refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. (PRTs) via PingID Windows Login Passwordless or username/password — requires PingOne for Workforce Plus or Premium license.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Changes the default Lock duration in MFA policies for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., Voice, and Email from 0 to 2 minutes in new environments to guard against brute-force attacks.
    • Extends Microsoft Entra ID hybrid join support to all geographies (previously US/North America only), enabling hybrid-joined Windows devices to obtain and renew primary refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. (PRTs) via PingID Windows Login Passwordless or username/password — requires PingOne for Workforce Plus or Premium license.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default Lock duration in MFA policies for SMS, Voice, and Email changes from 0 to 2 minutes in new environments — any automation or testing that assumes a 0-minute lock duration for these channels in freshly created environments will behave differently.
13. docs update Oct 6, 2026 · issue 096

    PingOne adds webhook status visibility, auto-enrollment from Verify to Recognize, and a new Account Updated notification template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds webhook status and last successful delivery visibility on the webhooks page in PingOne for each subscribed webhook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds auto-enrollment of a user's verified selfie into PingOne Recognize immediately after a successful PingOne Verify transaction, now generally available.
    • Adds a new Account Updated notification template in PingOne, usable via the PingOne connector in DaVinci to email users when their account is modified.
    • Adds new translation language packs for the PingOne admin console, enabling end users to interact in their preferred language.
    • Adds webhook status and last successful delivery visibility on the webhooks page in PingOne for each subscribed webhook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds auto-enrollment of a user's verified selfie into PingOne Recognize immediately after a successful PingOne Verify transaction, now generally available.
    • Adds a new Account Updated notification template in PingOne, usable via the PingOne connector in DaVinci to email users when their account is modified.

    1 more in Everything

14. docs update Oct 6, 2026 · issue 096

    MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Use Case Connector gains Remember Me, backup auth via one-time device, Update Device Nickname capability, and OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. Token Resync toggle with extraOtpRequired error.

    • Adds extraOtpRequired error output to the Finish Device Registration capability, prompting users for an additional verification code when OATH hardware token time-drift resync is required.
    • New integrationAdds Update Device Nickname capability to the MFA Use Case Connector, allowing device renaming post-registration when permitted by the MFA policy.
    • Adds an OATH Token Resync toggle in the Finish Device Registration capability for time-drift resync of OATH hardware tokens during device activation.
    • Adds Remember Me support to the MFA Use Case Connector, letting users skip re-authentication on trusted devices by enabling the option in the MFA policy and passing the Signals SDK payload to Check Authentication Policy and Finish Device Authentication.
    • Adds backup authentication support to Check Authentication Policy, enabling users who have lost their MFA device to authenticate via a one-time device (email or phone) from the organization's directory.

    5 details in Everything

15. docs update Oct 6, 2026 · issue 096
    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Notify users by email whenever their account is updated, using the new template in a DaVinci flow.
    📍In DaVinci, open your flow, add or configure the PingOne connector node, and select the Account Updated notification template as the email action to trigger on account modification events.
16. changelog Oct 5, 2026 · issue 095

    Adds multi-select node properties, telephone number user format, navigation profiles, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata signature skip, next-gen scripting engine default, and multi-node journey canvas selection.

    • Supports selecting multiple values from predefined options when configuring custom node properties in the node designer.
    • Adds telephone number as a user property format, with optional server-side validation and separate country code and phone number fields in hosted pages and the admin console.
    • Enables customizing the hosted account pages navigation menu for different user groups using navigation profiles.
    • Adds search and sort capabilities for the list of AI agent identities.
    • Enables skipping XML signature verification when importing remote SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. provider metadata.

    +7 more show less

    • Makes the next-generation scripting engine the default when creating scripts in the Advanced Identity Cloud admin console.
    • Adds runTargetPhase selection in the Advanced Identity Cloud admin console when running reconciliations.
    • Enables panning journey canvases by holding the space bar and dragging with the left mouse button.
    • Supports selecting multiple journey nodes by holding Shift and clicking each node.
    • Updated integrationAllows the LexisNexis DDP Profiler node to inject scripts in the head element or in an iframe.
    • Adds v2.0 of the LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Decision node and the Identity Store Decision node with improvements over the previous versions.
    • The reCAPTCHA Enterprise node now logs errors when its Google project, site key, or API key secret is misconfigured.

    12 details in Everything

    • New integration Microsoft Entra ID email provider integration
    • New supported platform EC key attestation for Android device binding
    └──▷ BREAKING ON UPGRADE

    • !ThreatMetrix nodes are renamed to LexisNexis Dynamic Decision Platform (DDP) nodes — any journeys or configurations referencing the old ThreatMetrix node names will need to be updated.
    • !v1.0 of the Page node is now deprecated; the latest version should be used instead.
17. changelog Oct 4, 2026 · issue 094

    Ping Identity adds multi-value node properties, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments./SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. email config, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata signature skip, and v2.0 LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Decision nodes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Configure a custom SMTP email provider and validate it works before relying on it for production identity journeys.
    📍In the Advanced Identity Cloud admin console, go to Email Provider settings, select Custom SMTP or Microsoft Entra ID, enter your provider credentials, then click Send Test Email to verify delivery.
    Skip XML signature verification when importing a remote SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata document from a provider that does not sign its metadata.
    📍In the Advanced Identity Cloud admin console, go to Federation › Remote Entity Providers, import a SAML 2.0 provider metadata URL, and enable the option to skip XML signature verification before saving.
    • Adds runTargetPhase selection in the Advanced Identity Cloud admin console when running reconciliations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds support for configuring Microsoft Entra ID or custom SMTP email providers in the Advanced Identity Cloud admin console, with the ability to send test emails.
    • Adds option to skip XML signature verification when importing remote SAML 2.0 provider metadata.
    • Adds v2.0 of the LDAP Decision node and the Identity Store Decision node with improvements over prior versions.
    • Adds EC key attestationEC key attestationA cryptographic proof that an elliptic-curve key pair was generated inside a specific hardware or software environment, letting a relying party verify the key's origin and that it has never been exported. support for Android device binding, enabling compatibility with newer Google hardware attestation root certificates.

    +11 more show less

    • Adds the ability to select multiple values from predefined options when configuring custom node properties in the node designer.
    • Adds telephone number as a user property format, with optional server-side validation and separate country code and phone number fields in hosted pages and the admin console.
    • Adds navigation profiles to customize the hosted account pages navigation menu for different groups of users.
    • Adds search and sort capabilities for the list of AI agent identities.
    • Makes the next-generation scripting engine the default and recommended option when creating scripts in the Advanced Identity Cloud admin console.
    • Adds pan support for journey canvases by holding the space bar and dragging with the left mouse button.
    • Adds multi-node selection on journey canvases by holding Shift and clicking each node.
    • Adds configuration option to the LexisNexis DDP Profiler node to inject scripts in the head element or in an iframe.
    • Renames ThreatMetrix nodes to LexisNexis Dynamic Decision Platform (DDP) nodes; updates LexisNexis InstantID Question and Answer (IIDQA) nodes to store decision API responses in shared state.
    • Adds logging of errors in the reCAPTCHA Enterprise node when its Google project, site key, or API key secret is misconfigured.
    • Backchannel transactions now record the authenticated subject on completion even when no session is created, preserving a subject declared before authentication.
    • Adds runTargetPhase selection in the Advanced Identity Cloud admin console when running reconciliations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds support for configuring Microsoft Entra ID or custom SMTP email providers in the Advanced Identity Cloud admin console, with the ability to send test emails.
    • Adds option to skip XML signature verification when importing remote SAML 2.0 provider metadata.
    • Adds EC key attestationEC key attestationA cryptographic proof that an elliptic-curve key pair was generated inside a specific hardware or software environment, letting a relying party verify the key's origin and that it has never been exported. support for Android device binding, enabling compatibility with newer Google hardware attestation root certificates.
    • Adds telephone number as a user property format, with optional server-side validation and separate country code and phone number fields in hosted pages and the admin console.

    +3 more show less

    • Adds navigation profiles to customize the hosted account pages navigation menu for different groups of users.
    • Adds pan support for journey canvases by holding the space bar and dragging with the left mouse button.
    • Adds multi-node selection on journey canvases by holding Shift and clicking each node.

    8 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !ThreatMetrix nodes have been renamed to LexisNexis Dynamic Decision Platform (DDP) nodes — any configuration or documentation referencing the old ThreatMetrix node names will need to be updated.
18. docs update Sep 29, 2026 · issue 089

    Authorize gateway 1.2.2 shuts down on policy retrieval failure instead of staying alive in an unhealthy state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Authorize gateway 1.2.2 now logs an error and shuts down when it cannot retrieve the latest authorization policy version from PingOne or the locally stored deployment configuration, replacing the previous behavior of remaining alive but unable to serve decision requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Authorize gateway 1.2.2 will shut down (instead of staying alive) when it cannot reach PingOne or load its local deployment configuration — any monitoring or restart logic that assumed a running-but-unhealthy gateway process must be updated.
19. docs update Sep 29, 2026 · issue 089

    Authorize gateway 1.2.2 shuts down cleanly when it cannot retrieve a valid policy version, replacing silent unhealthy state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ BREAKING ON UPGRADE

    • !Authorize gateway instances that previously stayed alive in an unhealthy state when policy retrieval failed will now shut down on upgrade to 1.2.2 — any automation or health-check logic that relied on the instance remaining running in that scenario will need to be updated.
20. 28 Sep 2026 (2026-09-29) Sep 29, 2026 · issue 089

    Ping Identity adds multi-value node properties, telephone format, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments./SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. email config, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. signature skip, and more in Sep 2026 release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Skip signature validation when federating with a partner whose SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata lacks a valid XML signature, avoiding import failures.
    📍In the admin console, go to Federation › Entity Providers › Import Remote Provider, upload the metadata file, and enable Skip XML signature verification before saving.
    Configure a Microsoft Entra ID or custom SMTP email provider and verify delivery with a test email before rolling out to users.
    📍In the Advanced Identity Cloud admin console, go to Settings › Email Provider, select Microsoft Entra ID or Custom SMTP, fill in the connection details, then click Send Test Email to confirm.
    Serve tailored navigation menus to different user groups on hosted account pages by assigning navigation profiles per group.
    📍In the Advanced Identity Cloud admin console, go to Hosted Pages › Navigation Profiles, create a profile for a user group, define the menu items, then assign the profile to the target group.
    • Adds runTargetPhase selection in the Advanced Identity Cloud admin console when running reconciliations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ability to skip XML signature verification when importing remote SAML 2.0 provider metadata.
    • Enables configuration of Microsoft Entra ID or custom SMTP email providers and test-email sending from the Advanced Identity Cloud admin console.
    • Supports telephone number as a user property format, with optional server-side validation and separate country code and phone number fields in journeys.
    • Allows selection of multiple values from predefined options when configuring custom node properties in the node designer.

    +6 more show less

    • Enables customization of the hosted account pages navigation menu for different user groups using navigation profiles.
    • Adds search and sort capabilities for the list of AI agent identities.
    • Makes the next-generation scripting engine the default and recommended option when creating scripts in the Advanced Identity Cloud admin console.
    • Allows configuring the LexisNexis DDP Profiler node to inject scripts in the head element or in an iframe.
    • Enables panning journey canvases by holding the space bar and dragging with the left mouse button.
    • Enables selecting multiple journey nodes by holding Shift and clicking each node.
    • Adds runTargetPhase selection in the Advanced Identity Cloud admin console when running reconciliations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ability to skip XML signature verification when importing remote SAML 2.0 provider metadata.
    • Enables configuration of Microsoft Entra ID or custom SMTP email providers and test-email sending from the Advanced Identity Cloud admin console.
    • Enables customization of the hosted account pages navigation menu for different user groups using navigation profiles.

    7 more in Everything

21. 28 Sep 2026 Sep 28, 2026 · release notes

    PingIdentity introduces navigation profiles for hosted pages, XML signature skip for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider., and script injection via LexisNexis node.

    └──▷ HOW TO FIND IT
    Skip signature checks for a remote SAML identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. metadata import.
    📍// In the admin console, when importing remote SAML 2.0 metadata, use the 'skip XML signature verification' option
    Configure a LexisNexis DDP Profiler node to inject scripts into an iframe.
    📍// In the journey designer, select the LexisNexis DDP Profiler node and configure injection location: iframe
    • Adds runTargetPhase selection in the admin console to control reconciliation execution phases
    • Adds navigation profiles to customize hosted account page menus for different user groups
    • Adds LexisNexis DDP Profiler node capability to inject scripts in head or iframe elements

    3 details in Everything

22. changelog Sep 26, 2026 · issue 086
    └──▷ HOW TO FIND IT
    Present MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enrollment QR codes to users in environments that block JavaScript (e.g., hardened kiosk browsers) by disabling JS rendering in registration nodes.
    📍In the journey editor, select the Push Registration, OATH Registration, or Combined MFA Registration node, open its properties, and enable the option Render QR code without JavaScript.
23. changelog Sep 25, 2026 · issue 085
    └──▷ USE IT
    Override the default outbound user agent for a specific external REST service call by setting the userAgent property, useful when a third-party API enforces a particular User-Agent string.
    json copy

    {
      "userAgent": "MyCompanyIntegration/1.0"
    }

    └──▷ BREAKING ON UPGRADE

    • !The ThreatMetrix nodes are renamed to LexisNexis Dynamic Decision Platform (DDP) nodes — any journeys or configurations referencing ThreatMetrix node names will need to be updated.
24. docs update Sep 25, 2026 · issue 085

    PingOne adds two early-access capabilities: Recognize auto-enrollment from Verify and NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions.-based identity verification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds PingOne Recognize auto-enrollment from PingOne Verify (early access), enabling automatic device recognition enrollment during a Verify flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds NFC verification from PingOne Verify (early access), supporting contactless NFC-based identity document verification.

    2 details in Everything

25. docs update Sep 25, 2026 · issue 085

    PingOne adds NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. ID verification, AI agent bot detection, encrypted OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. tokens, outbound group sync, and custom client IDs for imported apps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds Outbound Name field (defaulting to the CN part of the group name) and a Group Settings / Sync Status tab under the Provisioning tab, enabling outbound group sync provisioning of external groups to third-party applications such as AWS.
    • Enables setting a custom client ID and client secret via the PingOne API when importing OIDC-based applications and custom resources from solutions such as PingFederate or third-party tools — only for newly imported resources, not existing ones.
    • Adds NFC verification (early access) to PingOne Verify, letting users read secure NFC chips on government-issued IDs and passports via their mobile device.
    • Enhances the PingOne Protect Bot Detection predictor with new rules to identify specific computer-using agent (CUA) types, providing granular visibility into AI-driven activity — requires Protect (Signals) SDK for Web v5.6.10 and, for some workforce flows, PingID Device Trust agent v1.2 or later.
    • Releases PingID Device Trust agent v1.2 with improved data collection.

    +4 more show less

    • Releases Protect (Signals) SDK for Web v5.6.11.
    • Updates the environment creation workflow with a modern, simplified, license-driven UI that restricts service and product selection to what is included in the customer's agreement and distinguishes paid from trial environments.
    • Updates the environment Overview page UI with a new look and feel providing quick access to environment settings and resources.
    • Updates the Audit UI with a more modern, intuitive experience and a simplified time zone selector.
    • Adds Outbound Name field (defaulting to the CN part of the group name) and a Group Settings / Sync Status tab under the Provisioning tab, enabling outbound group sync provisioning of external groups to third-party applications such as AWS.
    • Enables setting a custom client ID and client secret via the PingOne API when importing OIDC-based applications and custom resources from solutions such as PingFederate or third-party tools — only for newly imported resources, not existing ones.
    • Adds NFC verification (early access) to PingOne Verify, letting users read secure NFC chips on government-issued IDs and passports via their mobile device.

    6 more in Everything

26. changelog Sep 24, 2026 · issue 084

    Ping Identity adds Friendly Captcha support, JavaScript-free QR codes, dynamic radio-button choices, and a configurable userAgent for external REST calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds userAgent property to external REST service configuration, defaulting to PingIdentity for outbound requests, overridable per-request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Friendly Captcha support to the v2.0 CAPTCHA node as a privacy-focused CAPTCHA provider alternative.
    • Adds an option to the Combined MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Registration, OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. Registration, and Push Registration nodes to render QR codes without using JavaScript.
    • Adds the ability in the v2.0 Choice Collector node to make choice callbacks with dynamically generated options that render as radio-button groups instead of drop-down lists.
    • Renames ThreatMetrix nodes to LexisNexis Dynamic Decision Platform (DDP) nodes, and updates LexisNexis InstantID Question and Answer (IIDQA) nodes to store decision API responses in shared state.

    +2 more show less

    • Enables updating a managed user even when the change conflicts with generated attribute values, propagating updates to all associated workforce application accounts during queued synchronization.
    • Reorganizes the admin console left menu into logical, collapsible groups with updated labels.
    • Adds userAgent property to external REST service configuration, defaulting to PingIdentity for outbound requests, overridable per-request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    6 more in Everything

27. docs update Sep 23, 2026 · issue 083

    Ping Identity: Adds Sync Updates Only field to the provisioning sync status UI, showing changes since the last successful sync for inbound rules when the source is a directory service (Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., PingDirectory, or OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network.).

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable AI agent type detection in Bot Detection to gain granular visibility into computer-using agent (CUA) activity — requires upgrading the Signals SDK to at least 5.6.10.
    📍In the PingOne admin console, go to Protect › Predictors › Bot Detection, enable the CUA-type detection rules, then update your web integration to load Signals SDK version 5.6.10 or later.
    • Adds signed-and-then-encrypted ID token and user information support for external OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., strengthening privacy and compliance when connecting to external OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. providers.
    • Releases improved PingOne Authentication Dashboard to general availability, now including PingOne DaVinci-triggered authentication activity for a unified view of sign-on activity from PingOne and DaVinci flows.
    • Adds signed-and-then-encrypted ID token and user information support for external OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., strengthening privacy and compliance when connecting to external OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. providers.

    1 more in Everything

28. docs update Sep 23, 2026 · issue 083

    Ping Identity: Enforces a baseline content security policycontent security policyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.) for all flows running on a PingOne domain in production environments, rolling out across production in phases.

    ⤢ ⤢ ⤢ ⤢
29. docs update Sep 23, 2026 · issue 083

    Ping Identity: Adds support for signed-and-then-encrypted ID tokens and user information returned by external OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. in PingOne.

    ⤢ ⤢ ⤢
    • Adds a Sync Updates Only field to the provisioning sync status UI, showing changes since the last successful sync for inbound rules where the source is a directory service (Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., PingDirectory, or OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network.).

    1 more in Everything

30. docs update Sep 22, 2026 · issue 082

    PingOne adds outbound group sync, custom client IDs/secrets via API, AI agent type detection, and Protect SDK 5.6.11⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable outbound group sync to AWS by configuring an outbound provisioning rule with a custom display name to avoid duplicates.
    📍In the PingOne admin console, go to your Directory group › Provisioning tab › Group Settings, set the Outbound Name field to a unique value (overriding the default CN), then save the outbound rule.
    • Supports setting a custom client ID and client secret for imported OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. applications and custom resources via the PingOne API, enabling migration from PingFederate or third-party solutions and recovery of accidentally deleted applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds outbound group sync provisioning for external groups, including a Group Settings tab with Sync Status and an Outbound Name field (defaulting to the CN portion of the group name) for syncing directory groups to third-party apps such as AWS.
    • Enhances the PingOne Protect Bot Detection predictor with new rules to identify specific computer-using agent (CUA) types for more granular AI-driven activity monitoring, requiring Protect (Signals) SDK version 5.6.10 or later and PingID Device Trust agent 1.2 or later for some workforce flows.
    • Releases Protect (Signals) SDK 5.6.11 for Web.
    • Releases PingID Device Trust agent version 1.2 with improved data collection.

    +2 more show less

    • Improves the environment creation workflow with a modernized, license-driven UI that surfaces only services and products included in the customer's agreement and distinguishes paid from trial environments.
    • Updates the environment Overview page UI with quick access to environment settings and resources.
    • Supports setting a custom client ID and client secret for imported OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. applications and custom resources via the PingOne API, enabling migration from PingFederate or third-party solutions and recovery of accidentally deleted applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds outbound group sync provisioning for external groups, including a Group Settings tab with Sync Status and an Outbound Name field (defaulting to the CN portion of the group name) for syncing directory groups to third-party apps such as AWS.

    5 more in Everything

31. docs update Sep 22, 2026 · issue 082

    PingOne DaVinci adds flow canvas Actions, inline variable editing, and a baseline CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. for production flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Add a predefined Action to a flow to insert a ready-made node collection for a specific task, rather than wiring individual nodes manually.
    📍In the flow canvas, open the options menu, select Actions, then choose the desired action to insert its predefined node collection into the flow.
    • Adds an Actions option to the flow canvas options menu, providing predefined collections of nodes for accomplishing specific narrow purposes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables direct editing of variables in connector configuration fields by clicking a chip after adding a variable from the { } menu, allowing users to copy, paste, or modify attribute and variable references inline.
    • Adds an Actions option to the flow canvas options menu, providing predefined collections of nodes for accomplishing specific narrow purposes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

32. docs update Sep 22, 2026 · issue 082

    Ping Identity: Updates the Audit UI with a more modern, intuitive experience and a simplified time zone selector.

    ⤢ ⤢ ⤢
33. changelog Sep 16, 2026 · issue 076

    Ping Identity: Supports EC key attestationEC key attestationA cryptographic proof that an elliptic-curve key pair was generated inside a specific hardware or software environment, letting a relying party verify the key's origin and that it has never been exported. for Android device binding, including compatibility with newer Google hardware attestation root certificates.

    └──▷ HOW TO FIND IT
    Enable resource servers to introspect tokens they receive via token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user., without needing a dedicated scope — configure the new provider setting in the OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. provider.
    📍In the admin console, go to Native Consoles › Access Management › Realms › <realm> › Services › OAuth2 Provider › Advanced, and enable Allow audience members to introspect tokens.
    Preserve DCR software statements in client configs so they are returned in read responses — useful for auditing which software statement a dynamically registered client used.
    📍In the admin console, go to Native Consoles › Access Management › Realms › <realm> › Services › OAuth2 Provider › Dynamic Registration, and enable Store Software Statement in OAuth2 Client.
    • Adds error logging to the reCAPTCHA Enterprise node when its Google project, site key, or API key secret is misconfigured.

    1 more in Everything

34. docs update Sep 16, 2026 · issue 076

    PingOne adds custom client IDs/secrets for imported apps, AI agent type detection in Bot Detection, and an updated Audit UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds support via the PingOne API for setting a custom client ID and client secret when importing OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.-based applications and custom resources from PingFederate or third-party solutions into PingOne.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enhances the PingOne Protect Bot Detection predictor with new rules to identify specific computer-using agent (CUA) types for more granular AI-driven activity monitoring, available in Protect (Signals) SDK 5.6.10 and later; workforce flows may also require PingID Device Trust agent version 1.2 or later.
    • Updates the Audit UI with a modernized interface and a simplified time zone selector.
    • Adds support via the PingOne API for setting a custom client ID and client secret when importing OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.-based applications and custom resources from PingFederate or third-party solutions into PingOne.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

35. docs update Sep 16, 2026 · issue 076

    PingOne DaVinci enforces a baseline content security policycontent security policyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.) for all production flows on PingOne domains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
36. docs update Sep 16, 2026 · issue 076

    Ping Identity: Releases Protect (Signals) SDK version 5.6.11 for Web.

    ⤢
    • Releases PingID Device Trust agent version 1.2 with improved data collection.

    1 more in Everything

37. changelog Sep 15, 2026 · issue 075

    Ping Identity adds ESV support for connector server names, inline script error visibility, and streamlined identity/job management UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports using an ESV (environment secret/variable) for the connector server name in connector configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Shows errors in the script editor when scripts use environment ESVs incorrectly.
    • Allows creating another identity immediately after creating one, without closing the modal.
    • Allows editing a scheduled job to start sooner than its originally configured future start time.
    • Allows closing modals with the Escape key.

    +2 more show less

    • Forms now clearly identify fields that contain errors after submission.
    • All connectors upgraded to version 1.5.20.36.
    • Supports using an ESV (environment secret/variable) for the connector server name in connector configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Shows errors in the script editor when scripts use environment ESVs incorrectly.

    5 more in Everything

38. 14 Sep 2026 (2026-09-15) Sep 15, 2026 · issue 076

    Ping Identity Advanced Identity Cloud adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. support, Rich Authorization DetailsRich Authorization DetailsAn OAuth 2.0 extension (RFC 9396) that lets a client embed fine-grained, structured permission metadata inside an authorization request, so a server can grant tokens scoped to exact actions rather than broad string-based scopes., and new LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./Identity Store Decision node versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable resource servers to introspect tokens they receive via token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. without requiring a dedicated scope — useful when deploying microservices that consume delegated tokens.
    📍In the Advanced Identity Cloud admin console, go to Native Consoles › Access Management › Services › OAuth 2.0 Provider, then enable the Allow audience members to introspect tokens setting and save.
    Preserve software statements across DCR lifecycle calls so downstream systems can audit the original client assertion on every read response.
    📍In the Advanced Identity Cloud admin console, go to Native Consoles › Access Management › Services › OAuth 2.0 Provider, then enable the Store Software Statement in OAuth2 Client setting and save.
    • Adds redirectUrlType and customRedirectUrl parameters to the backchannel transaction initialize endpoint, enabling customization of the redirect URI returned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Store Software Statement setting on the OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 provider to persist the software statement provided during dynamic client registration (DCR) in the client configuration and return it in DCR read responses.
    • Adds Allow audience members to introspect tokens setting on the OAuth 2.0 provider, permitting any client whose client_id appears in a token's aud claim to introspect that token without a special scope.
    • Adds Authentication Request Storage option on the hosted IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to configure where SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. authentication requests are stored, enabling concurrent SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. attempts across multiple browser tabs or browsers to complete independently.
    • Supports OAuth 2.0 Client ID Metadata DocumentsClient ID Metadata DocumentsOAuth 2.0 documents hosted at a client's own URL that declare its identity and redirect URIs, letting authorization servers fetch and verify client metadata without manual registration. (CIMD), allowing AI agents and external clients to identify themselves via a hosted metadata document without prior or dynamic client registration.

    +3 more show less

    • Enables issuance of access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. with authorization_detailsauthorization_detailsA structured JSON field defined in RFC 9396 (OAuth 2.0 Rich Authorization Requests) that lets a client declare fine-grained permissions beyond simple scopes, giving cyber tools precise access control in OAuth flows. through the authorization code and refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. grants when details were granted during authorization.
    • Adds v2.0 of the LDAP Decision node and the Identity Store Decision node with improved username handling.
    • Backchannel transactions now record the authenticated subject on completion even when no session is created, preserving any subject declared before authentication.
    • Adds redirectUrlType and customRedirectUrl parameters to the backchannel transaction initialize endpoint, enabling customization of the redirect URI returned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Authentication Request Storage option on the hosted IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to configure where SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. authentication requests are stored, enabling concurrent SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. attempts across multiple browser tabs or browsers to complete independently.
    • Supports OAuth 2.0 Client ID Metadata DocumentsClient ID Metadata DocumentsOAuth 2.0 documents hosted at a client's own URL that declare its identity and redirect URIs, letting authorization servers fetch and verify client metadata without manual registration. (CIMD), allowing AI agents and external clients to identify themselves via a hosted metadata document without prior or dynamic client registration.

    5 more in Everything

39. 14 Sep 2026 Sep 14, 2026 · release notes

    Ping Identity Advanced Identity Cloud 23604.0 adds CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. support, backchannel transaction recording, token introspection by audience, and OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. provider settings

    • oauth2.provider now supports Store Software Statement in OAuth2 Client to persist software statements from DCR in client configuration.
    • oauth2.provider allows access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. to include authorization_detailsauthorization_detailsA structured JSON field defined in RFC 9396 (OAuth 2.0 Rich Authorization Requests) that lets a client declare fine-grained permissions beyond simple scopes, giving cyber tools precise access control in OAuth flows. for authorization code and refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. grants when details were granted during authorization.
    • oauth2.provider introduces Allow audience members to introspect tokens setting enabling any client in a token’s aud claim to introspect that token.
    • Backchannel transaction initialize endpoint accepts redirectUrlType and customRedirectUrl parameters for customized redirect URI behavior.
    • Backchannel transactions now record the authenticated subject on completion even when no session is created, preserving pre-authentication subjects.

    +1 more show less

    • Hosted IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. adds Authentication Request Storage option to configure SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. authentication request storage location.

    6 details in Everything

40. docs update Sep 11, 2026 · issue 071

    PingOne adds Advanced Identity Cloud Tenant Auditor role and Aadhaar eID verification support via PingOne Verify.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Adds the Advanced Identity Cloud Tenant Auditor role for PingOne environments with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. to PingOne Advanced Identity Cloud, providing read-only access to tenant configuration and settings, assignable by administrators with the Advanced Identity Cloud Super Admin role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Aadhaar eID verification to PingOne Verify, allowing users to share identity attributes from their Aadhaar card via the government-backed digital wallet instead of image-only checks.

    2 details in Everything

41. docs update Sep 11, 2026 · issue 071

    PingFederate 13.1.3 adds JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface. driver/URL validation for Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. datastore config and richer audit logging for JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage., tokens, and lockouts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    • Adds JDBC driver and connection URL scheme validation controls restricting which drivers and URL schemes can be used when configuring datastores through the Admin API, adding defense in depth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an option for OAuth clients to ignore audience parameters during token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. and use the client's default access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. manager, simplifying configuration when requests contain varying resource URI values.
    • Expands PingFederate-generated logs to include JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. IDs (jti), hashed authorization codes, access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., and refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., plus which system (PingFederate or LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.) locked out users after failed login attempts.
    • Aligns administrative API audit logs with administrative console logs, eliminating nearly all differences between the two log sources.
    • Adds JDBC driver and connection URL scheme validation controls restricting which drivers and URL schemes can be used when configuring datastores through the Admin API, adding defense in depth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

42. docs update Sep 11, 2026 · issue 071

    PingOne DaVinci enforces a baseline Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. for all non-production environments on PingOne domains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Enforces a baseline Content Security Policy (CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.) for all flows running on a PingOne domain in non-production environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds improved CSP controls for all environments using custom domains.
    • Enforces a baseline Content Security Policy (CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.) for all flows running on a PingOne domain in non-production environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

43. docs update Sep 11, 2026 · issue 071
    ⤢
    └──▷ HOW TO FIND IT
    Grant an auditor read-only access to an Advanced Identity Cloud tenant without elevating them to Super Admin — useful for compliance reviewers or external auditors.
    📍In the PingOne admin console, go to Identities › Roles, select the target user, and assign the Advanced Identity Cloud Tenant Auditor role. Note: only users with the Advanced Identity Cloud Super Admin role can perform this assignment.
44. changelog Sep 8, 2026 · issue 068

    Ping Identity adds Friendly Captcha support, no-JS QR codes for MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. registration, IGAIGAIdentity Governance and Administration: a framework for managing user access rights, roles, and lifecycle across systems, giving cyber tools a structured data source for detecting privilege abuse or access anomalies. identity/role certification, and correlation rules for unmanaged apps.

    └──▷ USE IT
    Preserve the legacy GSM JWK kid format in environments where existing clients depend on the old version-only identifier.
    env copy

    esv.am.secrets.gsm.stableid.version.only=true

    • Adds esv.am.secrets.gsm.stableid.version.only environment variable to retain legacy Google Secret Manager JWK kid behavior when ESV secrets would otherwise use the new unique name-and-version identifier.
    • Adds support for Friendly Captcha to the v2 CAPTCHA node as a privacy-focused CAPTCHA provider alternative.
    • Adds an option to the Combined MFA Registration, OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. Registration, and Push Registration nodes to render QR codes without requiring JavaScript.
    • Adds IGA identity profile certification, enabling reviewers to certify identity records including external users and AI agents — not just access.
    • Adds IGA role composition certification, enabling reviewers to certify role definitions including attributes, glossary data, entitlements, applications, and membership rules.

    +9 more show less

    • Adds dedicated IGA certification review task views for identity-profile and role-composition items, letting reviewers examine and decide on each item type separately.
    • Adds IGA correlation rules for unmanaged applications, letting administrators link aggregated accounts to identities during account aggregation.
    • Adds IGA activity and notification monitoring as generally available, with event type filtering and audit log presentation.
    • Adds the ability to delete certificate templates via the IGA UI.
    • Adds the ability to change campaign title and owner after a campaign has been launched.
    • Adds creation of approval tasks when expiration is configured with a workflow variable.
    • IGA role request forms now display current role membership as read-only, and each member addition or removal in the role lifecycle management screen is submitted as an individual grant or removal request.
    • IGA now enforces the required request justification setting consistently across lifecycle management, request extension, and entitlement-grant requests.
    • Enables updating a managed user even when the change conflicts with generated attribute values, propagating the update to all associated workforce application accounts during queued synchronization.
    • Adds esv.am.secrets.gsm.stableid.version.only environment variable to retain legacy Google Secret Manager JWK kid behavior when ESV secrets would otherwise use the new unique name-and-version identifier.
    • Adds IGA identity profile certification, enabling reviewers to certify identity records including external users and AI agents — not just access.
    • Adds IGA role composition certification, enabling reviewers to certify role definitions including attributes, glossary data, entitlements, applications, and membership rules.
    • Adds dedicated IGA certification review task views for identity-profile and role-composition items, letting reviewers examine and decide on each item type separately.
    • Adds IGA correlation rules for unmanaged applications, letting administrators link aggregated accounts to identities during account aggregation.

    +3 more show less

    • Adds IGA activity and notification monitoring as generally available, with event type filtering and audit log presentation.
    • Adds the ability to delete certificate templates via the IGA UI.
    • Adds the ability to change campaign title and owner after a campaign has been launched.

    6 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Advanced Identity Cloud now rejects relationship creation requests that use a property that does not accept the referenced object type, instead of silently creating the relationship through a different valid property — existing integrations relying on the silent fallback behavior will now receive errors.
    • !ESV secrets are now stored in Google Secret Manager using a unique name-and-version identifier as the default JWK kid; deployments where multiple secrets shared the same GSM version must set esv.am.secrets.gsm.stableid.version.only to retain the legacy kid value.
45. docs update Sep 4, 2026 · issue 064

    PingOne launches a remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. (early access) letting AI clients administer PingOne via OAuth over a single Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable the Remote MCP Server in a non-production environment so AI clients can begin administering PingOne via MCP tools.
    📍In the PingOne admin console, go to Settings › MCP Server, then click Enable MCP Access.
    • New MCP Server page under Settings in the PingOne admin console lets administrators enable or disable the Remote MCP Server per environment via Enable MCP Access (disabled by default); requires the Environment Admin role or equivalent.
    • All MCP tools enforce PingOne's existing roles and permissions model, so administrators can only invoke tools their current roles permit.

    2 details in Everything

46. docs update Sep 4, 2026 · issue 064

    PingOne Remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. is now available as an early access feature.

47. docs update Sep 4, 2026 · issue 064

    PingOne adds a Remote MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for AI-driven identity ops, an Authorize gateway API tab, and Canadian region support for Workforce.

    ⤢ ⤢ ⤢ ⤢
    • Adds the PingOne Remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server (early access): a hosted Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server with a single administrator-restricted endpoint on PingOne infrastructure, a dedicated PingOne MCP Server system application for admin auth and agent authorization, per-environment enable/disable settings, and dual-context audit logging attributing every create, update, delete, and sensitive read to both the MCP client and the authorizing administrator.
    • Supports MCP hosts including Claude, Cursor, Visual Studio Code, and Codex, plus PingOne DaVinci and PingOne platform management MCP tools.
    • Adds an API tab to the Authorize gateway details page for viewing and copying the gateway ID, environment ID, and API URL in one place.
    • PingOne for Workforce is now available in the Canada geography — select the PingOne MFA service when creating a new environment there.
    • Automatic handling of the required risk evaluation update step in DaVinci flows that use the PingOne Protect connector, eliminating the need to configure it manually in most cases.

    +1 more show less

    • PingOne Forms renderer modernized with expanded ARIA attribute usage, improved keyboard navigation, enhanced screen reader role assignments, and better validation feedback; the Preview Rendering Updates for Forms option has been removed from Flow Settings as the preview period has ended.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Preview Rendering Updates for Forms option has been removed from Flow Settings; the new Forms renderer is now active for all environments with no opt-out.
48. docs update Sep 4, 2026 · issue 064

    PingOne DaVinci gains per-flow custom content security policies and modernized Forms rendering with improved accessibility.

    ⤢ ⤢ ⤢ ⤢
    • Adds custom content security policycontent security policyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.) options, now generally available, allowing full CSP customization per flow.
    • Improves PingOne Forms rendering with enhanced ARIA attribute usage, focus management, keyboard navigation, screen reader support, and error messaging.

    2 details in Everything

49. docs update Sep 4, 2026 · issue 064

    Ping Identity: Adds the PingOne Remote MCP Server (early access) — a hosted Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server with a single administrator-restricted endpoint on PingOne infrastructure, a dedicated PingOne MCP Server system application for admin auth and agent authorization, per-environment enable/disable settings, and dual-context audit logging attributing every create/update/delete/sensitive-read to both the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client and the authorizing administrator.

    ⤢
    └──▷ BREAKING ON UPGRADE

    • !The Preview Rendering Updates for Forms option has been removed from Flow Settings; the preview period has ended and the new rendering is now the only mode.
50. 02 Sep 2026 (2026-09-03) Sep 3, 2026 · issue 064

    Ping Identity adds Friendly Captcha support, no-JS QR codes for MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. registration, IGAIGAIdentity Governance and Administration: a framework for managing user access rights, roles, and lifecycle across systems, giving cyber tools a structured data source for detecting privilege abuse or access anomalies. identity/role certification, and activity monitoring GA.

    └──▷ USE IT
    Preserve the legacy GSM JWK kid format after upgrading, to avoid breaking existing key references that depend on the version-only identifier.
    env copy

    esv.am.secrets.gsm.stableid.version.only=true

    • Adds Friendly Captcha support to the v2 CAPTCHA node as a privacy-focused CAPTCHA provider alternative.
    • Combined MFA Registration, OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. Registration, and Push Registration nodes now include an option to render QR codes without JavaScript.
    • IGA activity and notification monitoring is now generally available, with improved event type filtering and audit log presentation.
    • IGA identity profile certification enables reviewers to certify identity records — including external users and AI agents — rather than access alone.
    • IGA role composition certification enables reviewers to certify role definitions, including attributes, glossary data, entitlements, applications, and membership rules.

    +8 more show less

    • IGA certification review views let reviewers examine identity-profile and role-composition items in dedicated task views.
    • IGA correlation rules for unmanaged applications let administrators link aggregated accounts to identities during account aggregation.
    • IGA now lets you delete certificate templates via the UI.
    • IGA now lets you change the campaign title and owner after a campaign is launched.
    • IGA role request forms display current role membership as read-only; each member addition or removal in the role lifecycle management screen is submitted as an individual grant or removal request.
    • Approval tasks can now be created when expiration is configured with a workflow variable.
    • Managed user updates that conflict with generated attribute values are now accepted and propagate to all associated workforce application accounts during queued synchronization.
    • Advanced Identity Cloud now rejects relationship creation requests that reference a property not accepting the given object type, rather than silently routing through a different property.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ESV secrets in Google Secret Manager now default to a unique name-and-version identifier as the JWK kid; installations relying on the legacy GSM-version-only kid must set the esv.am.secrets.gsm.stableid.version.only environment variable to true to preserve prior behavior.
    • !Advanced Identity Cloud now rejects relationship creation requests that use a property not accepting the referenced object type; previously these were silently created via a different valid property.
51. 02 Sep 2026 Sep 2, 2026 · release notes

    Ping Identity v23453.0 adds JS-free QR rendering, Friendly Captcha, IGAIGAIdentity Governance and Administration: a framework for managing user access rights, roles, and lifecycle across systems, giving cyber tools a structured data source for detecting privilege abuse or access anomalies. campaign editing and certification, and GSM-backed ESV secrets via env var.

    └──▷ USE IT
    Render QR codes server-side for accessibility or headless testing without requiring client JS.
    json copy

    <Journey JSON snippet>
    'nodeId': 'mfa-qr',
    'nodeType': 'CombinedMFANode',
    'useJavaScript': false
    </Journey JSON snippet>

    Override the default User-Agent for outbound REST calls to identify the client specifically.
    json copy

    <External REST Service Config>
    'userAgent': 'MyApp-Connector/1.0'
    </External REST Service Config>

    • config: Adds the useJavaScript option (default false) to Combined MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Registration, OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. Registration, and Push Registration nodes to render QR codes without client-side JavaScript
    • config: IGA lifecycle management, request extension, and entitlement-grant requests now consistently enforce the required request justification setting
    • config: IGA role request forms now display current role membership as read-only and submit individual grant/removal requests for each member change
    • new: IGA activity and notification monitoring is generally available with improved event type filtering and audit log presentation
    • config: IGA correlation rules for unmanaged applications allow linking aggregated accounts to identities during account aggregation

    +7 more show less

    • config: IGA identity profile certification enables reviewers to certify identity records, including external users and AI agents
    • config: IGA role composition certification enables reviewers to certify role definitions including attributes, glossary data, entitlements, applications, and membership rules
    • config: IGA certification review views let reviewers examine identity-profile and role-composition items in dedicated task views and make decisions
    • config: Approval tasks can be created when expiration is configured with a workflow variable in IGA workflows
    • new: v2.0 CAPTCHA node adds support for Friendly Captcha as a privacy-focused provider
    • config: You can now update a managed user even when the change conflicts with generated attribute values, propagating to all associated workforce application accounts during queued synchronization
    • api: The external REST service now uses PingIdentity as the default User-Agent for outbound requests, overridable via the userAgent property in the config file

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !esv.am.secrets.gsm.stableid.version.only environment variable must be set to true to retain legacy ESV secret behavior; otherwise, secrets are stored using a unique name-and-version identifier in Google Secret Manager (GSM)
52. docs update Aug 28, 2026 · issue 058

    PingOne adds Snowflake provisioning, structured FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. error routing in DaVinci, and extends client secret retention to 90 days.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable legacy FIDO2 error handling in a DaVinci flow when you need client-side errors to continue to the success path for backward-compatible decisioning.
    📍In PingOne DaVinci, open the Form connector capability for FIDO2/WebAuthn › locate Use Legacy FIDO2 Error Handling › enable the toggle to route client errors to the success (true) path instead of the structured error output.
    • Adds a Use Legacy FIDO2 Error Handling toggle in the Form connector for FIDO2/WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. capabilities in PingOne DaVinci flows — disabled by default — so client-side errors route to a typed error output object containing name, code, and message fields, enabling conditional branching without custom Functions connector logic.
    • Adds Snowflake as a provisioning connection target, supporting user and group provisioning between a Snowflake account and PingOne.
    • Increases the maximum client secret retention period for applications and custom resources from 30 days to 90 days.

    3 details in Everything

53. docs update Aug 28, 2026 · issue 058

    DaVinci Form connector now routes FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it./WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. client errors to structured, typed outputs for precise flow branching.

    ⤢ ⤢ ⤢ ⤢
    • FIDO2/WebAuthn client-side errors in the Form connector now route to a structured error output object containing name, code, and message fields, enabling flow branching on specific failure conditions without custom Functions connector logic.
    • New Use Legacy FIDO2 Error Handling toggle in the Form connector controls whether client errors route to the typed error outcome (default, toggle disabled) or continue to the success path (toggle enabled).

    2 details in Everything

54. docs update Aug 28, 2026 · issue 058
    ⤢
    └──▷ HOW TO FIND IT
    Route FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. authentication failures to specific DaVinci flow branches based on structured error fields rather than writing custom Functions connector logic.
    📍In your DaVinci flow, open the Form connector node for FIDO2 authentication › locate the Use Legacy FIDO2 Error Handling toggle › leave it disabled (default) › wire the error outcome branch to downstream nodes that inspect the typed error object's name, code, and message fields to drive conditional logic.
    • Adds a Use Legacy FIDO2 Error Handling toggle in the PingOne DaVinci Form connector to control whether client-side FIDO2/WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. errors route to a structured typed error output (with name, code, and message fields) or continue to the success path; toggle is disabled by default, enabling structured error branching.
55. changelog Aug 24, 2026 · issue 055

    Ping Identity adds ESV support for connector server names, inline script error visibility, and streamlined identity/job editing workflows.

    • Enables use of an ESV (Environment Secret/Variable) for the connector server name in the New Connector Server modal.
    • Surfaces script errors directly in the script editor when scripts reference environment ESVs incorrectly.
    • Allows creating another identity immediately after creating one, without closing the modal.
    • Supports editing a future-scheduled job to start sooner.
    • Moves the Identity Verification page under Integrations, Android Key Attestation under Authentication Methods, and Security Questions under Authentication.

    +2 more show less

    • Adds Escape key support for closing modals.
    • Form submissions now clearly highlight fields containing errors.

    7 details in Everything

56. docs update Aug 19, 2026 · issue 050

    PingOne adds Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. provisioning, external group name mapping, and credential reset/delete capabilities.

    ⤢ ⤢ ⤢ ⤢
    • Adds a Microsoft Entra ID provisioning connection, enabling bidirectional provisioning of users and groups between Microsoft Entra ID and PingOne.
    • Supports mapping attributes from Microsoft Entra ID to the External Group Names attribute in PingOne, enabling group-based application access control using Microsoft group membership.
    • Adds reset and delete capabilities for credential records directly from a user's profile in PingOne.

    3 details in Everything

57. docs update Aug 19, 2026 · issue 050

    PingOne adds Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. provisioning, external group name mapping, and credential reset/delete capabilities.

    ⤢
    • Adds bidirectional user and group provisioning between Microsoft Entra ID and PingOne via a new provisioning connection.
    • Adds the ability to map Microsoft Entra ID attributes to the External Group Names attribute in PingOne, enabling group-based application access control using Microsoft group membership.
    • Adds reset and delete actions for credential records directly from a user's profile in PingOne.

    3 details in Everything

58. 18 Aug 2026 (2026-08-19) Aug 19, 2026 · issue 050

    Ping Identity adds continuous identity creation, ESV support in connector server config, and script editor ESV error visibility.

    • Enables use of an ESV for the connector server name in the New Connector Server modal.
    • Surfaces errors in the script editor when scripts reference environment ESVs incorrectly.
    • Allows creating another identity immediately after creating one, without closing the modal.
    • Enables editing a future-scheduled job to start sooner.
    • Moves the Identity Verification page under Integrations; Android Key Attestation under Authentication Methods; Security Questions under Authentication.

    +3 more show less

    • Supports closing modals with the Escape key.
    • Improves keyboard navigation and accessibility information across interactive controls.
    • Forms now clearly identify fields containing errors after submission.

    8 details in Everything

59. 18 Aug 2026 Aug 18, 2026 · release notes

    PingOne AI Cloud v23251.0 adds ESV support in connector modals and fixes modal UX

    • Enables reuse of environment ESVCs (ESVC) values for the connector server name in the New Connector Server modal.
    • Allows sequential identity creation without closing the modal, improving workflow efficiency.

    2 details in Everything

60. docs update Aug 14, 2026 · issue 045

    PingOne Forms gains custom image support with configurable sizing, positioning, padding, and dynamic URL binding.

    ⤢ ⤢ ⤢ ⤢
    • Adds custom image support to the PingOne Forms drag-and-drop form builder, with configurable sizing, positioning, and padding, plus static or dynamic hyperlink attachment.
    • Supports dynamic image URLs resolved at runtime via the node, alongside static public image URLs entered directly in the form.
    • Allows HTML attributes — id, class, and referrerpolicy — to be set on form images.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upcoming changes to PingOne Forms HTML rendering (preview period starting June 29) may break automated tests that assert on specific HTML structures.
61. docs update Aug 12, 2026 · issue 043

    PingOne adds early-access support for creating verify policies.

    • Introduces early-access capability to create verify policies in PingOne.

    1 detail in Everything

62. docs update Aug 12, 2026 · issue 043

    PingOne adds attribute-to-scope mapping for custom resources, auto-enrollment from Verify to Recognize, and dynamic form outcomes in DaVinci.

    ⤢ ⤢ ⤢ ⤢
    • Adds attribute mapping for custom resource scopes, allowing control over which attributes are included in access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. based on the requested scopes.
    • Adds early-access auto-enrollment of a user's verified selfie into PingOne Recognize immediately after a successful PingOne Verify verification.
    • Adds a Use Active Theme option in the DaVinci Form connector that applies whichever theme is currently active when a flow runs, enabling centralized theme control from Branding & Themes.
    • Renames the previous PingOne Active Theme static selection to <theme name> (Active) and moves it to a new Static Selection section in the Form connector.
    • Adds dynamic multiple outcomes to the Show Form capability in DaVinci, generating outcomes based on selected form configuration so flows can branch directly from each outcome.

    +2 more show less

    • Introduces Show Form (Legacy) label for the previous Show Form capability, with existing nodes switchable to the new capability via node settings without losing configuration.
    • Moves the PingOne Forms connector to the Core category and renames it the Form connector.

    7 details in Everything

63. docs update Aug 12, 2026 · issue 043

    PingOne adds attribute mapping for custom resource scopes, auto-enrollment in Recognize, and dynamic Show Form outcomes in DaVinci.

    ⤢
    • Adds attribute mapping to scopes defined for custom resources, enabling control over which attributes are included in access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. based on requested scopes.
    • New Use Active Theme option in the Form connector applies whichever theme is currently active when a DaVinci flow runs, replacing the need to hard-code a theme ID.
    • Show Form in DaVinci now generates outcomes dynamically based on the selected form configuration, with per-outcome branching directly from the node; prior behavior moves to Show Form (Legacy).
    • Auto-enrollment of a verified selfie into PingOne Recognize immediately after a successful PingOne Verify verification is now available as an early access feature.
    • The PingOne Forms connector is renamed to Form connector and moved to the Core category in DaVinci.

    5 details in Everything

64. changelog Aug 9, 2026 · issue 040

    Ping Identity adds AI agent identities, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata import options, PKCS5S2 migration, and optional custom report parameters.

    • Adds the ability to skip signature verification when importing SAML metadata (OPENAM-26721).
    • Adds support for migrating user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm (FRAAS-33086).
    • Adds the ability to mark parameters in custom reports as optional, giving more flexibility when running reports (IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.-10610).
    • Adds v2.0 of the Patch Object node in Advanced Identity Cloud journey flows (OPENAM-26073).
    • Introduces AI agent identities to secure AI-driven solutions.

    +3 more show less

    • Adds the ability to send email from next-generation scripts.
    • The promotions API now returns report metadata ordered by creation date, most recent first (FRAAS-33591).
    • Advanced Identity Cloud now honors the pubKeyCredParams sequence in WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. credential creation requests (OPENAM-25556).

    8 details in Everything

65. docs update Aug 8, 2026 · issue 039

    PingOne now supports provisioning users and groups between two PingOne environments within the same organization.

    ⤢ ⤢ ⤢ ⤢
66. docs update Aug 8, 2026 · issue 039

    PingOne gains cross-environment user/group provisioning and Verify configuration in Verify policies.

    ⤢
    • Adds PingOne provisioning connection, enabling provisioning of users and groups between two PingOne environments within the same organization.
    • Adds Verify configuration support within PingOne Verify policies.

    2 details in Everything

67. docs update Aug 6, 2026 · issue 037

    PingOne /as/signoff endpoint now accepts HTTP POST for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. RP-initiated sign-offs; Android Signals SDK 5.4.0 released.

    ⤢ ⤢ ⤢ ⤢
    • The /as/signoff endpoint now accepts HTTP POST requests in addition to HTTP GET for OIDC relying party (RP)-initiated sign-offs, giving applications more flexibility in how they trigger user sign-offs.
    • Releases version 5.4.0 of the PingOne Protect (Signals) SDK for Android.

    2 details in Everything

68. docs update Aug 6, 2026 · issue 037

    PingOne /as/signoff endpoint now accepts HTTP POST for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. RP-initiated sign-offs; Protect Signals SDK 5.4.0 released for Android.

    ⤢
    • Adds HTTP POST support to the /as/signoff endpoint for OIDC relying party (RP)-initiated sign-offs, alongside the existing HTTP GET method.
    • Releases version 5.4.0 of the PingOne Protect (Signals) SDK for Android.

    2 details in Everything

69. docs update Jul 31, 2026 · issue 031

    PingOne adds bulk Authorize decisions, HubSpot/Webex provisioning, webhook alerting, Apple App Attest, and DaVinci audit events GA

    └──▷ HOW TO FIND IT
    Subscribe to webhook delivery failure alerts so your team is notified immediately when a destination becomes unreachable.
    📍In the PingOne console, go to Integrations › Webhooks, open the target webhook, enable the alert option for webhook destination failure, then use Test Connection to validate delivery status before saving.
    • Adds bulk decision requests to PingOne Authorize, allowing multiple access scenarios to be evaluated in a single API call to reduce network overhead and latency in high-throughput environments.
    • New HubSpot provisioning connection enables user and group synchronization between HubSpot and PingOne.
    • New Webex provisioning connection enables user and group synchronization between Webex and PingOne.
    • Adds ability to directly import and export individual DaVinci forms, independent of a full flow import.
    • New webhook alert option notifies users via email when a webhook destination delivery failure occurs.

    +6 more show less

    • New webhook test connection feature lets users review the latest delivery status and validate connectivity to a webhook destination.
    • PingOne MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. mobile SDK 2.4 adds support for structured concurrency via Kotlin suspend functions (Android) and Swift Concurrency async functions (iOS).
    • PingOne MFA mobile SDK 2.4 adds support for Apple App Attest for iOS device integrity checking.
    • MFA SDK 2.4 switches Google Play Integrity API usage from classic to standard requests for improved security and performance.
    • DaVinci administrative audit events released for general availability.
    • PingOne Verify document capture updated to Microblink version 8.0, adding expanded barcode support and document-specific improvements.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The PingOne MFA mobile SDK 2.4 raises the minimum required iOS version to iOS 16.
70. docs update Jul 31, 2026 · issue 031

    DaVinci adds GA audit events, CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. enforcement option, and reusable action collections on the flow canvas.

    • DaVinci administrative audit events are now generally available, surfacing admin activity for audit and compliance workflows.
    • Adds an enforcement mode option to the baseline Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSP) feature, moving beyond report-only mode.
    • Adds Actions to the flow canvas options menu — predefined collections of nodes designed to accomplish specific narrow purposes.

    3 details in Everything

71. docs update Jul 31, 2026 · issue 031

    PingOne adds bulk Authorize decisions, HubSpot/Webex provisioning, webhook alerts, and Apple App Attest iOS integrity checking

    └──▷ HOW TO FIND IT
    Subscribe to webhook delivery failure alerts so your team is notified immediately when a destination becomes unreachable.
    📍In the PingOne console, go to Integrations › Webhooks, select your webhook, navigate to the Alerts section, and enable the webhook destination failure alert to receive email notifications on delivery failures.
    Validate webhook connectivity before relying on it in production by checking the latest delivery status.
    📍In the PingOne console, go to Integrations › Webhooks, select your webhook, and use the Test Connection feature to review the latest delivery status and confirm connectivity to the destination.
    • Adds bulk decision requests to PingOne Authorize endpoints, letting you evaluate multiple access scenarios in a single API call to reduce network overhead and latency in high-throughput environments.
    • Adds HubSpot provisioning connection, enabling user and group sync between HubSpot and PingOne.
    • Adds Webex provisioning connection, enabling user and group sync between Webex and PingOne.
    • Adds ability to import and export individual DaVinci forms directly, without requiring a full flow import.
    • Adds a new webhook alert option that sends email notifications when a webhook destination delivery fails.

    +7 more show less

    • Adds webhook test connection functionality so users can review the latest delivery status and validate connectivity to a destination.
    • Releases DaVinci administrative audit events for general availability.
    • PingOne MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. mobile SDK 2.4 adds Kotlin suspend functions alongside existing callback-based functions for structured concurrency support on Android.
    • PingOne MFA mobile SDK 2.4 adds Swift async functions alongside existing callback-based functions for Swift Concurrency framework support on iOS.
    • PingOne MFA mobile SDK 2.4 adds Apple App Attest support for iOS device integrity checking.
    • PingOne MFA mobile SDK 2.4 switches to Google Play Integrity API standard requests for improved security and performance on Android.
    • PingOne Verify document capture updated to Microblink version 8.0, adding expanded barcode support and document-specific improvements.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The minimum iOS version required for apps using the PingOne MFA mobile SDK is now iOS 16.
72. changelog Jul 24, 2026 · issue 024

    Ping Identity AIC adds email scripting, secrets in nodes, Rich Authorization Requests, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata import options, and a new validate-secrets endpoint.

    • Adds emailService binding for next-generation scripts, enabling email delivery directly from journey scripts.
    • New realm-level OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Provider setting enables Rich Authorization Requests (RFC 9396) processing when an RCSRCSRich Communication Services, a messaging protocol standard maintained by the GSMA that replaces SMS with richer features like read receipts, file transfer, and group chat over carrier or IP networks. is configured, and controls advertisement of authorization_details_types_supported on the well-known endpoint.
    • Individual OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. clients can now be configured with Authorization Detail Type(s) to restrict which authorization detail types each client may request.
    • Dynamic client registration requests now support authorization_details_types to declare the authorization detail types a client supports at registration time.
    • SAML metadata import now supports skipping signature verification.

    +12 more show less

    • Introduces Patch Object node v2.0, which always updates managed identity objects as Advanced Identity Cloud (v1.0 deprecated but still functional).
    • OAuth 2.0 request state is now stored in CTS (Core Token Service) instead of an oversized browser cookie, preventing large requests (e.g., with big id_token_hint) from failing after authentication.
    • Custom report parameters can now be marked as optional, providing more flexibility when running reports.
    • Proxy Connect enabled tenants can now manage Proxy Connect configuration directly in the Advanced Identity Cloud admin console without using the API.
    • Hosted journey pages now display hCaptcha text and challenges in the end user's configured locale.
    • Column visibility preferences for data tables in the admin console and hosted account pages are now customizable and saved between sessions.
    • Super administrators can now configure the redirect URI to use a custom domain when setting up federated administrator access.
    • Social identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. can now be created and edited directly in the Advanced Identity Cloud admin console.
    • Self-service journey mappings can now be configured directly in the Advanced Identity Cloud admin console.
    • The promotions API now returns report metadata ordered by creation date, most recent first.
    • Journey annotation notes now display multi-line formatting in view mode.
    • Page node v3 is now available, generating a new CAPTCHA token for each validation request when both CAPTCHA and live password validation are used together.

    17 details in Everything

73. docs update Jul 24, 2026 · docs issue 004

    Ping Identity AIC adds email scripting, secrets in nodes, Rich Authorization Requests, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata import options, and a new validate-secrets endpoint.

    • Adds emailService binding for next-generation scripts, enabling email delivery directly from journey scripts.
    • New realm-level OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Provider setting enables Rich Authorization Requests (RFC 9396) processing when an RCSRCSRich Communication Services, a messaging protocol standard maintained by the GSMA that replaces SMS with richer features like read receipts, file transfer, and group chat over carrier or IP networks. is configured, and controls advertisement of authorization_details_types_supported on the well-known endpoint.
    • Individual OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. clients can now be configured with Authorization Detail Type(s) to restrict which authorization detail types each client may request.
    • Dynamic client registration requests now support authorization_details_types to declare the authorization detail types a client supports at registration time.
    • SAML metadata import now supports skipping signature verification.

    +12 more show less

    • Introduces Patch Object node v2.0, which always updates managed identity objects as Advanced Identity Cloud (v1.0 deprecated but still functional).
    • OAuth 2.0 request state is now stored in CTS (Core Token Service) instead of an oversized browser cookie, preventing large requests (e.g., with big id_token_hint) from failing after authentication.
    • Custom report parameters can now be marked as optional, providing more flexibility when running reports.
    • Proxy Connect enabled tenants can now manage Proxy Connect configuration directly in the Advanced Identity Cloud admin console without using the API.
    • Hosted journey pages now display hCaptcha text and challenges in the end user's configured locale.
    • Column visibility preferences for data tables in the admin console and hosted account pages are now customizable and saved between sessions.
    • Super administrators can now configure the redirect URI to use a custom domain when setting up federated administrator access.
    • Social identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. can now be created and edited directly in the Advanced Identity Cloud admin console.
    • Self-service journey mappings can now be configured directly in the Advanced Identity Cloud admin console.
    • The promotions API now returns report metadata ordered by creation date, most recent first.
    • Journey annotation notes now display multi-line formatting in view mode.
    • Page node v3 is now available, generating a new CAPTCHA token for each validation request when both CAPTCHA and live password validation are used together.

    17 details in Everything

74. docs update Jul 23, 2026 · issue 023

    LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. gateway 4.4.0 adds group LDAP filter support for selective inbound provisioning to PingOne.

75. docs update Jul 23, 2026 · docs issue 004

    LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. gateway 4.4.0 adds group LDAP filter support for selective inbound provisioning to PingOne.

76. docs update Jul 23, 2026 · issue 023

    LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. gateway 4.4.0 adds group LDAP filter support for selective inbound provisioning into PingOne.

77. 21 Jul 2026 (2026-07-22) Jul 22, 2026 · issue 023

    Advanced Identity Cloud adds emailService binding for next-gen scripts, managed secret references in custom nodes, and a new secret validation endpoint.

    └──▷ TRY IT
    Validate that a secret mapping resolves correctly in the configured secret store before relying on it in production.
    copy

    $ curl -X POST \
      'https://<tenant>.forgeblocks.com/am/json/realms/root/realm-config/secrets/stores/<store-id>/mappings/<mapping-id>?_action=validate' \
      -H 'Authorization: Bearer <access-token>' \
      -H 'Content-Type: application/json'

    • Custom scripted nodes can now reference managed secrets from a secret store using a SECRET property type, keeping API keys and passwords out of script code.
    • Custom scripted nodes now support combining multivalued: true with options to create multi-select list properties in the journey designer.
    • New validate action on the secrets endpoint lets operators confirm whether a secret mapping resolves to a valid secret in the configured secret store.
    • The Enable Connection via Credential toggle for the PingOne Worker service now automatically enables or disables relevant connection fields based on selection.

    4 details in Everything

78. docs update Jul 21, 2026 · issue 021

    DaVinci flow timeout analytics now expose errorType, errorCode, and errorMessage in analytics and webhook events.

    └──▷ BREAKING ON UPGRADE

    • !DaVinci response headers will be changed to lower case beginning July 20 — any downstream logic that matches on mixed-case response header names may break.
79. 20 Jul 2026 (2026-07-21) Jul 21, 2026 · issue 021

    Ping Identity adds Rich Authorization Requests (RFC 9396) support, per-client authorization detail types, and a new Patch Object node v2.0.

    └──▷ HOW TO FIND IT
    Restrict which authorization detail types a specific OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client may request, scoping RAR to only the types relevant to that client.
    📍In the Admin console, go to Applications › OAuth 2.0 Clients › <your client> › Advanced and set the Authorization Detail Type(s) field to the permitted types, then save.
    • New realm-level OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Provider setting Enable Rich Authorization Requests with RCS enables processing of authorization_detailsauthorization_detailsA structured JSON field defined in RFC 9396 (OAuth 2.0 Rich Authorization Requests) that lets a client declare fine-grained permissions beyond simple scopes, giving cyber tools precise access control in OAuth flows. requests when an RCSRCSRich Communication Services, a messaging protocol standard maintained by the GSMA that replaces SMS with richer features like read receipts, file transfer, and group chat over carrier or IP networks. is configured and controls advertisement of authorization_details_types_supported on the well-known endpoint.
    • Supports configuring Authorization Detail Type(s) on individual OAuth 2.0 clients to control which RFC 9396 Rich Authorization Request detail types each client can request.
    • Dynamic client registration requests can now include authorization_details_types to declare the authorization detail types a client supports.
    • Adds the ability to skip signature verification when importing SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata.
    • New v2.0 of the Patch Object node always updates the managed identity object as Advanced Identity Cloud, removing the Patch as Object configuration option (v1.0 is deprecated but remains functional in existing journeys).

    5 details in Everything

80. 21 Jul 2026 Jul 21, 2026 · release notes

    Adds emailService script binding and validate action on secrets endpoint

    • Adds the emailService next-generation script binding to send email directly from scripts
    • Adds a new validate action on the secrets endpoint to check if a secret mapping resolves correctly

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default Minimum Secret Key Length on the OATHOATHAn open standard for one-time passwords (TOTP and HOTP), maintained by an IETF working group, giving cyber tools a vendor-neutral way to implement two-factor authentication. Registration and Combined MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Registration nodes has increased from 32 to 40 characters
81. 20 Jul 2026 Jul 20, 2026 · release notes

    Adds RCSRCSRich Communication Services, a messaging protocol standard maintained by the GSMA that replaces SMS with richer features like read receipts, file transfer, and group chat over carrier or IP networks. support in OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. provider settings, per-client authorization detail types, dynamic client registration extensions, and skip signature verification for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata

    • Adds Enable Rich Authorization Requests with RCS realm-level setting to control processing of authorization_detailsauthorization_detailsA structured JSON field defined in RFC 9396 (OAuth 2.0 Rich Authorization Requests) that lets a client declare fine-grained permissions beyond simple scopes, giving cyber tools precise access control in OAuth flows. requests and advertising authorization_details_types_supported on the well-known endpoint
    • Adds per-client Authorization Detail Type(s) configuration to specify which RFC 9396 authorization detail types each OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client can request
    • Allows dynamic client registration requests to include authorization_details_types field to register supported authorization detail types for an OAuth 2.0 client
    • Adds ability to skip signature verification when importing SAML metadata via the new import option

    4 details in Everything

82. 16 Jul 2026 (2026-07-17) Jul 17, 2026 · issue 018

    Ping Identity AIC adds optional custom report parameters, ordered promotions API results, and multi-line journey annotations.

    • Supports marking parameters in custom reports as optional, enabling more flexible report execution.
    • Promotions API now returns report metadata ordered by creation date, most recent first.
    • Journey annotation notes now render multi-line formatting in view mode, consistent with edit mode.

    3 details in Everything

83. 16 Jul 2026 Jul 16, 2026 · release notes

    Promotions API returns metadata ordered by date; custom reports support optional parameters; Journey annotations support multi-line formatting.

    • The promotions API now returns report metadata ordered by creation date, with the most recent first
    • You can now mark parameters in custom reports as optional, giving you more flexibility when running reports

    2 details in Everything

84. 08 Jul 2026 (2026-07-09) Jul 9, 2026 · issue 014

    Ping Identity AIC adds social IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. management, self-service journey mapping, PKCS5S2 migration, and expanded ESV support in the admin console.

    └──▷ HOW TO FIND IT
    Manage Proxy Connect configuration through the UI instead of making API calls — useful for tenants who want to avoid direct API access for routine config changes.
    📍In the admin console, go to Settings › Proxy Connect and update your Proxy Connect configuration directly in the panel.
    Use an ESV to centrally manage and rotate the from address for email providers without hardcoding values in the console.
    📍In the admin console, go to Email Provider settings, and set the From Address field to an ESV reference (e.g., &esv.email.from.address).
    Create or edit a social identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. entirely within the admin console, avoiding manual API calls.
    📍In the admin console, go to Identities › Social Identity Providers, then select Create Provider or edit an existing one.
    • Extends the Evaluator Version selector in the admin console to all remaining next-generation script types: OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. node, Social Provider Handler node, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. scripts, and Policy Condition scripts.
    • Enables migration of user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm.
    • Adds an Account Status column (Active/Inactive) to the Identities page.
    • Supports using an environment secret or variable (ESV) to configure the from address for email providers.
    • Allows Proxy Connect–enabled tenants to manage Proxy Connect configuration directly in the admin console without using the API.

    +7 more show less

    • Localizes hCaptcha text and challenges on hosted journey pages to match the end user's configured locale.
    • Makes column visibility preferences for data tables in the admin console and hosted account pages customizable and persistent across sessions.
    • Adds an Enable AI Agents button on the AI Agents page when the feature has not yet been activated.
    • Allows super administrators to configure a custom-domain redirect URI when setting up federated administrator access.
    • Enables creation and editing of social identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. directly in the Advanced Identity Cloud admin console.
    • Supports configuring self-service journey mappings directly in the Advanced Identity Cloud admin console.
    • Microsoft 365 SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. applications now use the selected UPN Attribute Name setting for WS-Trust username authentication (existing applications must be resaved).

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Microsoft 365 SSO applications now use the selected UPN Attribute Name setting for WS-Trust username authentication; existing applications must be resaved for this change to take effect.
85. 08 Jul 2026 Jul 8, 2026 · release notes

    Advanced Identity Cloud adds PKCS5S2 migration, ESV for email from, Proxy Connect UI, and social IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. management in v22555.0.

    • Evaluator Version selector available for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. node, Social Provider Handler node, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. scripts, and Policy Condition scripts
    • Migration of user accounts from deprecated PKCS5S2 password hashing to a more secure algorithm
    • Manage Proxy Connect configuration directly in the Advanced Identity Cloud admin console without using the API
    • Create and edit social identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. in the Advanced Identity Cloud admin console
    • Configure self-service journey mappings directly in the Advanced Identity Cloud admin console

    5 details in Everything

86. 04 Jun 2026 (2026-06-05) Jun 5, 2026 · release notes

    PingOne adds Agent Governance for AI identities and node versioning for Auth Trees

    └──▷ HOW TO FIND IT
    Govern AI agents alongside human identities in Identity Governance.
    📍Use Agent Governance to detect and onboard AI agents
    Restrict application access to a subset of users authenticated through a specific journey.
    📍Assign an authorization policy to a SAML or OIDC application via IAM-4646
    Configure node versioning for authentication trees via the API.
    shell copy

    curl -X PUT 'https://<tenant-env-fqdn>/am/json/realms/root/realms/alpha/realm-config/authentication/authenticationtrees/nodes/UsernameCollectorNode/2.0' -H 'Accept-API-Version: protocol=2.1,resource=3.0' -d '{...}'

    • Identity Governance role LCM (IGAIGAIdentity Governance and Administration: a framework for managing user access rights, roles, and lifecycle across systems, giving cyber tools a structured data source for detecting privilege abuse or access anomalies.-4265): Allows designated end users to create, update, and delete roles on behalf of others via workflow-driven requests without full admin access.
    • Identity Governance for AI agents (IGA-4223): Detects, onboards, and governs AI agents alongside human identities using Agent Governance.
    • Advanced Identity Cloud now supports the WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. conditional UI (passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. autofill) in authentication nodes.
    • You can now assign an authorization policy to a SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. application via IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.-4646 to restrict access to specific authenticated subsets.
    • SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. REST and SaaS REST (connector server) applications now let you add filter policies to object types when configuring provisioning to reduce network overhead.

    +5 more show less

    • The PingOne worker service now lets you configure the connection to PingOne using a credential JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store..
    • You can now configure a trusted CA certificate for each OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client using the tls_client_auth authentication method via OPENAM-27540.
    • Advanced Identity Cloud supports node versioning with new versions for Page, Username, WebAuthn Authentication, and WebAuthn Registration nodes.
    • Adds Resource version 3.0 to the realm-config/authentication/authenticationtrees endpoint requiring Accept-API-Version: protocol=2.1,resource=3.0.
    • The realm-config/authentication/authenticationtrees/nodes endpoint is now versioned; specify the node version in the URL (e.g., .../nodes/UsernameCollectorNode/2.0).

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Resource versions 1.0 and 2.0 for the authenticationtrees REST endpoint are deprecated.
    • !Versionless node endpoints are deprecated; you must specify the node version in the request URL (e.g., .../nodes/UsernameCollectorNode/2.0).
87. 04 Jun 2026 Jun 4, 2026 · release notes

    PingOne adds AI agent governance, role LCM, WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. conditional UI, and node versioning to Identity Governance and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.

    └──▷ USE IT
    Configure a version-aware request to retrieve Username nodes.
    shell copy

    curl -H 'Accept-API-Version: protocol=2.1,resource=3.0' https://<tenant-env-fqdn>/am/json/realms/root/realm-config/authentication/authenticationtrees/nodes/UsernameCollectorNode/2.0

    • Adds Agent Governance capabilities to detect, onboard, and govern AI agents alongside human identities.
    • Introduces role lifecycle management (LCM) allowing end users to create, update, and delete roles via workflow-driven requests.
    • Adds support for WebAuthn conditional UI (passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. autofill) in the authentication journey nodes.
    • Adds node versioning support for Username, WebAuthn Authentication, and WebAuthn Registration nodes with version-aware API endpoints.
    • Enables assigning authorization policies to SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. applications via the IAM-9608 enhancement.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Resource versions 1.0 and 2.0 for authenticationtrees REST endpoint are deprecated; clients must set Accept-API-Version: protocol=2.1,resource=3.0.
    • !Versionless node endpoints are deprecated; the realm-config/authentication/authenticationtrees/nodes URL must specify the node version (e.g., /nodes/UsernameCollectorNode/2.0).
88. 17 Apr 2026 Apr 17, 2026 · release notes

    Adds authnRequestHelper binding to next-gen SP adapter scripts for AuthnRequest manipulation

89. 14 Apr 2026 Apr 14, 2026 · release notes

    New Snowflake connector for Identity Cloud, Access Modeling role mining, UI-driven session/config options, and report import/export

    • Bundled Snowflake connector allows managing users, roles, and data sync between Advanced Identity Cloud and Snowflake.
    • Added Access Modeling (role mining) feature in Identity Governance to discover potential access roles using machine learning.
    • Added UI options Override authenticated session timeout, Maximum Session Time, and Maximum Idle Time in the admin console journey editor (previously REST-only).
    • Added promotion rollbacks capability in the Advanced Identity Cloud admin console.
    • Added ability to import custom reports via the admin console.

    +2 more show less

    • Added ability to export custom reports via the admin console.
    • Expanded monitoring search feature to include /payload/message and /payload fields.

    7 details in Everything

90. 09 Apr 2026 Apr 9, 2026 · release notes

    New API endpoint for enabling AI Agents and two new Identity Governance log sources

    └──▷ TRY IT
    Enable the AI Agents feature in a Ping Identity sandbox environment via API.
    copy

    $ curl -X POST 'https://<pingone-env-id>/environment/aiagent?_action=enable' -H 'Authorization: Bearer <access_token>'

    • Adds /environment/aiagent?_action=enable endpoint to simplify enabling AI Agents in sandbox environments
    • Adds iga-api log source for monitoring Identity Governance API events, certifications, SOD, glossary, and LCM
    • Adds jas log source for monitoring Java API Service (JAS) identity management audit messages

    3 details in Everything

91. 30 Mar 2026 Mar 30, 2026 · release notes

    New AI agent identity support enables OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client onboarding for secure AI-driven solutions.

    • Adds Identity for AI (IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.-9357) capability allowing AI agents to be onboarded as specialized OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 clients with distinct identities.

    1 detail in Everything

92. 24 Mar 2026 Mar 24, 2026 · release notes

    PingOne adds Rich Authorization Requests support, App Policy Decision node, and next-gen script bindings.

    • /authorize and /par endpoints now accept the authorization_detailsauthorization_detailsA structured JSON field defined in RFC 9396 (OAuth 2.0 Rich Authorization Requests) that lets a client declare fine-grained permissions beyond simple scopes, giving cyber tools precise access control in OAuth flows. parameter for fine-grained authorization via RAR (RFC 9396)
    • New App Policy Decision node enables enforcing OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. application access policies in journeys with filtering by group, organization, etc.
    • OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Token Exchange now supports specifying audience parameters that are allowlisted and included in the resulting token's aud claim
    • jwtValidator and jwtAssertion bindings are available in all next-generation scripts for scripted JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. operations
    • Next-generation scripts include utils.base64url.encode() and utils.base64url.decodeToBytes() for Base64URL encoding/decoding

    +3 more show less

    • PingOne Worker Service connection can now be configured using a credential JWT (AME-33973)
    • New scopeValidatorHelper binding with inheritAccessTokenScopesOnRefresh() method in next-generation OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 scope validation scripts
    • Next-generation OAuth 2.0 scope validation scripts gain access to the availableScopes binding and throwInvalidScope() method

    8 details in Everything

93. 18 Mar 2026 Mar 18, 2026 · release notes

    New Policy Decision and Backchannel Notification nodes; improved cert collection via new ESV.

    • Policy Decision node evaluates authorization policies against resources within an authentication journey
    • Backchannel Notification node sends real-time status updates from a backchannel journey to the main auth journey
    • New ESV esv-am-nodes-certificatechain-validation-enforced enables collecting the full certificate chain in Certificate Collector/Validation nodes
    • PingOne Protect Initialize node gains Additional Signals SDK Initialization Options attribute for extended configuration
    • PingOneProtectInitializeCallback introduces universalDeviceIdentification field replacing deprecated enableTrust

    5 details in Everything

94. 18 Feb 2026 Feb 18, 2026 · release notes

    Adds esv-global-saml-error-page-http-binding ESV variable and device management options in hosted pages.

    └──▷ HOW TO FIND IT
    Users can now manage their registered devices directly from the hosted account interface, including renaming or removing them.
    📍In the hosted account pages, navigate to the Devices section for each device to view metadata and manage it.
    • Adds the esv-global-saml-error-page-http-binding environment variable to override the HTTP binding (HTTP-POST or HTTP-Redirect) used for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. error page redirects
    • Adds new device management capabilities in hosted account pages, allowing users to view last sign-on time, add date, edit device name, and delete devices

    2 details in Everything

95. 13 Feb 2026 Feb 13, 2026 · release notes

    Next-gen scripting engine for OAuth/SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. scripts; new REST actions and nodes for Identity Cloud

    └──▷ TRY IT
    Verify connectivity from Advanced Identity Cloud to PingOne using the new REST action
    copy

    $ curl -X POST 'https://<aic-host>/idp/rest/realm-config/services/pingOneWorkerService/workers/<pingone-worker-service-name>?action=testConnection' -H 'Authorization: Bearer <token>'

    Retrieve the latest node definitions for all authentication tree nodes in a single call
    copy

    $ curl -X GET 'https://<aic-host>/idp/rest/realm-config/authentication/authenticationtrees/nodes?action=listLatestNodeDefinitions' -H 'Authorization: Bearer <token>'

    Include a custom device ID and browser cookie in PingOne Protect evaluations via configuration properties
    copy

    $ curl -X PUT 'https://<aic-host>/idp/rest/realm-config/services/pingIdentityPingOneProtectEvaluation' -H 'Content-Type: application/json' -d '{"customDeviceId": "<device-id>", "customBrowserCookie": "<cookie-name>"}'

    • OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. AME scripts (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. claims, Scripted JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. validator, Scope validation, Authorize endpoint data provider, Scope evaluation, May act) can now use the next-generation scripting engine with utils and openidm bindings
    • SAML 2.0SAML 2.0A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. SP adapter, IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. adapter, and IDP attribute mapper scripts can now use the next-generation scripting engine with utils and openidm bindings
    • Adds application context configuration to hosted IdP or remote SP entity config to make samlApplication binding available for all SAML flows
    • Backchannel Initialize node gains an Allow Retry option for end users to retry failed backchannel authentication journeys
    • Pushed consent requests can now include remote consent agent credentials in a Basic Authentication header

    +11 more show less

    • New testConnection action on /realm-config/services/pingOneWorkerService/workers/<pingone-worker-service-name> endpoint tests connectivity from Advanced Identity Cloud to PingOne
    • New listLatestNodeDefinitions action on /realm-config/authentication/authenticationtrees/nodes returns combined node definitions for the latest version of each node
    • RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. Decision node captures Vendor-Specific Attributes (VSA) returned by the RADIUS server during authentication
    • PingOne Protect Evaluation node adds configuration properties to specify a custom session ID, custom browser cookie, and external deviceId
    • PingOne Verify Evaluation node gains a property to enable automatic redirection after verification in Redirect delivery mode
    • New RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. SecurID node replaces the deprecated Marketplace RSA SecurID node
    • New JWT Password Replay node secures the user’s password within an encrypted JWT for PingGateway
    • Device Binding and Device Signing Verifier nodes allow specifying clock skew between client device and AIC
    • Set Success Details, Set Failure Details, and Set Error Details nodes now support setting custom headers on journey outcomes
    • New locales binding returns localized strings from a translation map in Configuration Provider, Journey Decision, and Device Match node scripts
    • Added identity.exists() method to next-generation objects returned by idRepository.getIdentity()

    16 details in Everything

96. 06 Feb 2026 Feb 6, 2026 · release notes

    PingOne adds support for canceling clustered reconciliation via unavailable routes and restores PingOne Protect Username Node State setting

    • Adds ability to cancel a clustered reconciliation even when a route associated with the source or target system is unavailable (OPENIDM-21493)
    • Switches Advanced Identity Cloud identity management service to use synchronous HTTP client requests for external connections, preventing connection closure exceptions from terminating reconciliation

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The pageSize can no longer be configured outside the range of 10 to 100 (defaults remain 100, but values > maxQueueSize / 10 are automatically adjusted).