Okta vs Ping Identity

Choose Okta when

• you want a list price per user to budget from before talking to sales
• Workday changes such as terminations must reach the identity provider in real time
• you want governance and privileged access sold in the same per-user suite as sign-in

Choose Ping Identity when

• identity software must run in your own data center or cloud account
• you want a dedicated single-tenant cloud with separate dev, staging and production environments
• you need a federation hub that bridges many identity providers and service providers

Deployment models

Okta

Okta sells cloud-based offerings, mainly on multi-year subscriptions. For customer identity, Auth0 Private Cloud runs a dedicated cloud instance of the Auth0 Platform on a choice of cloud providers.

Ping Identity

PingOne is the multi-tenant cloud. PingOne Advanced Identity Cloud is single-tenant SaaS with Dev, Staging and Prod environments run by Ping. PingOne Advanced Services hosts PingFederate, PingAccess, PingDirectory and PingCentral in a dedicated tenant. The same products, plus PingAM, PingIDM, PingDS and PingGateway, are sold as software you install on premises or in your own cloud.

Choose Ping if the identity provider itself must run on infrastructure you control.

Pricing and what is counted

Okta

Workforce suites are priced per user per month. Starter lists at $6 and Essentials at $17. Professional and Enterprise are quoted. Products in a suite share one license count, except Workflows, Privileged Access and machine-to-machine tokens. Most products can also be bought on their own.

Ping Identity

Ping publishes no prices and asks buyers to contact sales for a quote. PingOne cloud products count annual or monthly active users. Self-managed software counts stored identities, whether or not they are active. The PingOne workforce bundles are P14W Essential, with basic PingID MFA, and P14W Plus, with full PingID MFA.

Okta charges per licensed user; Ping's cloud counts users active during the period, so compare quotes on the same population.

Federation and legacy apps

Okta

Access Gateway brings on-premises apps under the Okta Platform without code changes. API Access Management keeps one set of permissions per user across every API. Both are add-ons to lower suites and included in Enterprise. Secure Partner Access, for business partners, is sold as an add-on.

Ping Identity

PingFederate is a federation server for SAML 2.0, OAuth 2.0 and OpenID Connect. It can bridge many identity providers to many service providers. It includes a WS-Trust security token service and translates between SAML, JWT and WS-Fed tokens. PingAccess enforces access policy for web apps and APIs through agents or a gateway.

Ping's federation server handles WS-Trust and many-to-many partner federation; Okta extends its cloud to on-premises apps through a gateway.

HR-driven provisioning

Okta

Okta offers three Workday import types: full, incremental and Real Time Sync. Real Time Sync starts when a Workday business process sends a trigger to Okta. Lifecycle Management then provisions to downstream apps.

Ping Identity

PingOne provisions in from Workday and out to Workday. Inbound Workday polling runs every 15 minutes. An LDAP gateway provisions to and from Active Directory or PingDirectory. In self-managed and single-tenant deployments, PingIDM and Lifecycle Automation handle joiner, mover and leaver provisioning.

Okta takes event-driven updates from Workday; PingOne polls Workday every 15 minutes.

Governance and privileged access

Okta

Okta Identity Governance is an add-on combining Access Governance, Lifecycle Management and Workflows. Access Governance is not sold alone. Okta Privileged Access covers servers, SaaS apps and Active Directory accounts, licensed in Resource Units, with unlimited secrets.

Ping Identity

Advanced Identity Cloud sells governance as modules: Identity Workflow, Access Request, Access Review, Segregation of Duties and Role Modeling. Identity Workflow is required for the others. PingOne Privilege grants just-in-time access to servers, databases, VMs and Kubernetes clusters, and is not licensed by monthly active users.

Ping sells governance module by module, including segregation of duties; Okta sells it as one add-on.

Customer identity

Okta

The required Enterprise base platform for Okta Customer Identity lists at $3,000 a month on an annual contract. Add-ons are metered, for example by monthly active users. The B2C and B2B suites are quoted. Auth0 is a separate platform aimed at developers.

Ping Identity

PingOne's customer bundles are P14C Essential and P14C Plus. Plus adds full DaVinci, PingOne MFA and API Access Management. DaVinci builds sign-up and sign-in journeys on a drag-and-drop canvas with hundreds of prebuilt connectors. PingOne Verify checks documents, selfies and liveness.

Both sell customer identity apart from workforce; Ping offers identity verification and journey orchestration within PingOne.

Identity must run in your own data center or cloud account

Ping. PingFederate, PingAM, PingIDM, PingDirectory and the rest are sold as software you install.

A federation hub between many partner identity providers and your apps

Ping. PingFederate bridges multiple identity providers to multiple service providers. Okta sells Secure Partner Access as an add-on for business partner access.

Workday terminations must cut access within minutes

Okta. Real Time Sync starts on a Workday trigger. PingOne polls Workday every 15 minutes.

Customer sign-up that needs document and selfie checks

Ping sells PingOne Verify for document, selfie and liveness checks. Ask Okta which verification services it supports.