Ping Identity
live verifiedPing Identity · Per-user published rates with a 5,000-user contractual minimum. The minimum, not the rate, is what makes Ping enterprise-only.
Ping does publish per-user Workforce rates — $3/user/mo Essential and $6 Plus — and the rate looks competitive. The 5,000-user minimum is what prices it as an enterprise-only product: the floor is $180,000/yr at Essential whether you have 5,000 seats or 500. Below roughly 10,000 seats every other commercial IdP in this cohort is cheaper. PingOne for Workforce publishes exactly two tiers, Essential and Plus. PingOne for Customers is a separate line priced as an annual flat fee (Essential from $35,000/yr, Plus from $50,000/yr) — do not read those figures across to Workforce. Self-hosted PingFederate is a separate product and is not priced on the pricing page.
1.Year-1 TCO breakdown
Representative buyer: 200 employees, 30 SaaS apps, full SAML + MFA + lifecycle automation, 90-day audit retention.
2.The hidden cost category for this IdP
The 5,000-user minimum, not the rate. Ping's $3/user/mo Workforce Essential rate is published and looks like the cheapest in the cohort. It is only reachable if you have 5,000 seats. Every buyer below that pays the same $180,000/yr floor, so the effective per-user cost rises as the organisation gets smaller — about $15/user/mo at 1,000 seats, $75 at 200, $150 at 100. Two adjacent traps: PingOne for Customers is a separate product line priced as an annual flat fee from $35,000 (Essential) and $50,000 (Plus), and those figures get misread across to Workforce; and self-hosted PingFederate is a different product again, not priced on the pricing page at all. Procurement overhead is real on top of that — enterprise sales cycle, SOW, multi-product bundling.
3.Migration cost out of Ping Identity
Migration off Ping splits sharply by deployment shape. Cloud-only PingOne deployments move like any other standards-based IdP. On-prem PingFederate is the expensive case in this cohort, because long-lived PingFederate estates accumulate deep customisation — adapters, custom token mappings, integration with on-prem directories — and none of that is exportable. If you are on PingFederate, the honest planning assumption is that the custom-integration rebuild dominates every other line combined; scope it by counting adapters and custom mappings rather than by app count.
4.The negotiation lever
The minimum, and the bundle. Ping's published floor is the thing to attack first: if you are materially below 5,000 seats, the 5,000-seat minimum is the entire conversation and is worth more than any rate concession. Second lever is product count — Ping sells PingFederate, PingOne, PingID, PingDirectory and PingAccess, and multi-product deals are negotiated as a bundle rather than summed à-la-carte. Ping publishes no discount schedule; if you need three or more products, make them price the bundle before you price the parts.
5.Vendor tier reference
| Tier | Per-user (USD/mo) | Features |
|---|---|---|
| PingOne for Workforce Essential | $3 | 5,000-user minimum × $3 × 12 = $180,000/yr floor on an annual contract |
| PingOne for Workforce Plus | $6 | Adds risk-based MFA, advanced governance. Same 5,000-user minimum = $360,000/yr floor |