Ping One
Solution: PingOne
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Publisher | Microsoft Corporation |
| Support Tier | Microsoft |
| Support Link | https://support.microsoft.com |
| Categories | Identity |
| Version | 3.0.0 |
| Author | Microsoft - support@microsoft.com |
| First Published | 2025-04-20 |
| Last Updated | 2025-04-20 |
| Solution Folder | PingOne |
| Marketplace | Azure Marketplace · Popularity: 🟡 Low (38%) |
The PingOne solution provides the capability to ingest PingOne audit activity logs into Microsoft Sentinel using the PingOne Platform API.
Underlying Microsoft Technologies used:
This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs
• Codeless Connector Framework (CCF)
Contents
Data Connectors
This solution provides 1 data connector(s):
Tables Used
This solution uses 1 table(s):
| Table | Used By Connectors | Used By Content |
|---|---|---|
PingOne_AuditActivitiesV2_CL |
Ping One (via Codeless Connector Framework) | - |
Additional Documentation
📄 Source: PingOne/README.md
Ping Identity – PingOne Audit Logs CCP Connector
Summary
This Microsoft Sentinel data connector enables ingestion of audit activity logs from PingOne via the CCP framework. These logs capture administrative actions, configuration changes, sign-in attempts, and other audit-relevant events across the PingOne platform.
This solution helps security teams monitor identity infrastructure for suspicious behavior, policy violations, and compliance-relevant changes by sending normalized audit data to Microsoft Sentinel in near real-time.
Features
- Connects to the PingOne Audit Activities API.
- Parses and ingests audit logs into the custom Log Analytics table:
PingOne_AuditActivitiesV2_CL. - Uses secure OAuth 2.0 Client Credentials for authentication.
- Integrates into Sentinel analytics, hunting queries, and incident detection.
Prerequisites
- A valid PingOne tenant.
- A Client Credentials application in PingOne with:
- Client ID
- Client Secret
- Environment ID
- APi domain
- Necessary roles are manadatory to generate tokens and view Audit logs.
- Access to an Azure subscription with Microsoft Sentinel enabled and permissions to deploy Data Connectors.
Generating PingOne OAuth Client Credentials
- Sign into the PingOne Identity portal
- Go to Connections > Applications.
- Click Add Application and select your preferred app.
- Assign the required roles:
p1:read:audit(Audit role added via custom roles)- Assign Environment Admin role from predefined roles. (Needed to generate token)
- Can add other suitable roles according to your needs,
- without adding the roles, logs would not be ingested.
- Ensure the token auth method in OIDC settings is 'Client Secret Post' enabled in configaration section of App.
- The grant type in OIDC settings should be 'Client Credentials'
- Ensure the application is enabled.
- Save the following values:
- Client ID
- Client Secret
- Environment ID (available in the PingOne URL or Environment settings)
- Api domain ( available in the PingOne URL )
These credentials are required for connector deployment.
Deployment Parameters
- Client ID
- Client Secret
- Environment ID
- Api domain
Once deployed, the connector will begin ingesting audit logs from PingOne and send them to the PingOne_AuditActivitiesV2_CL table in your Sentinel workspace.
Post-Deployment Steps
Assign Required Roles
Ensure the deployed Data Connector has the required permissions to write to Log Analytics:
- Go to Microsoft Sentinel > Configuration > Data Connectors.
- Find the PingOne connector in the list and open it.
- Ensure the connector has appropriate permissions to send data to your Log Analytics Workspace.
How Logs are Generated
[Content truncated...]
Release Notes
| Version | Date Modified (DD-MM-YYYY) | Change History |
|---|---|---|
| 3.0.2 | 14-08-2025 | PingOne CCF Data Connector moving to GA |
| 3.0.1 | 23-07-2025 | Update to CCF Data Connector Readme File Link |
| 3.0.0 | 23-06-2025 | Initial Solution release with one CCF Data Connector |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊