Hey folks, just wrapped up a six-month migration from PingFederate to Microsoft Entra ID (formerly Azure AD) for our mid-sized org. We were running a mix of on-prem and cloud apps, and the project had its moments 😅. Wanted to share some real-world takeaways that might help anyone considering a similar jump.
**What dramatically improved:**
* **The developer experience for modern apps.** If your stack is heavy on Microsoft 365, Azure services, or even just modern OIDC/OAuth, Entra ID feels native. The app registration, secret management, and API permission workflows are just smoother and better documented.
* **Seamless conditional access.** Setting up geo-blocking, device compliance checks, and risk-based policies became way more intuitive. The portal guides you through it, and the policies "stick" better than our old rule sets in Ping.
* **Integrated SaaS provisioning.** For apps like Salesforce, Workday, and ServiceNow that support it, the out-of-the-box provisioning (SCIM) saved us writing a bunch of custom sync jobs. It's not perfect for every app, but where it works, it's a huge time saver.
**What broke or got harder:**
* **Legacy app support.** Our handful of old SAML 1.1 apps and weird WS-Fed implementations needed significant rework. Entra ID can do it, but it sometimes feels like you're forcing a square peg into a round hole. We ended up rewriting two internal apps to use modern protocols.
* **Granular delegation model.** The shift from Ping's very fine-grained administrative roles to Entra ID's built-in roles (Global Admin, User Admin, etc.) was an adjustment. We had to use Privileged Identity Management (PIM) and custom roles more than expected to meet our least-privilege goals.
* **Initial custom claim rules.** The claim transformation syntax in Entra ID is powerful but different. Our first few attempts at complex SAML claim mappings had some hiccups, causing brief login failures for a niche app. Test thoroughly in a non-prod tenant!
Overall, the consolidation of our identity layer feels cleaner, and the daily admin overhead is lower. But the migration wasn't a simple "lift and shift"—it forced us to modernize some of our tech debt, which was probably a good thing in the long run.
Anyone else made this switch? Would love to compare notes on handling hybrid scenarios or monitoring.
- Kev
I'm a staff platform engineer at a 500-person SaaS company, hybrid infra across AWS and Azure. We've been running Entra ID in production for our workforce identity for three years, after migrating from a smaller third-party IDP, and we support about 180 applications.
- **Price-to-complexity ratio:** Entra ID is brutally expensive if you need Premium P2 features (Conditional Access, Identity Protection) across your entire user base. You'll pay roughly $9-16/user/month for the needed Microsoft 365 license plus P2 add-on. For mid-market, this can be a shock. Ping's licensing model is often cheaper for complex, non-Microsoft ecosystems, but you pay in admin overhead.
- **Legacy protocol support:** This is where you'll bleed. Entra ID's WS-Federation and SAML implementations work, but for quirky, on-prem Java apps using obscure SAML attributes or non-standard bindings, we had to build proxy services. One app required a small, persistent Azure Function to reinterpret the claim. Ping handled these as configuration; Entra ID required code.
- **Operational overhead:** Day-two ops flipped. Entra ID eliminated our Ping server patching, clustering, and certificate cycling, but it introduced new overhead in monitoring Entra-specific logs (via Diagnostic Settings to a Log Analytics workspace, at additional cost) and managing the sprawling consent and permission model. A developer can, in two clicks, grant an app the ability to read all user profiles, and you'll only know if you've built the audit pipeline.
- **Hybrid agent reality:** The Entra Connect (sync) agent is reliable, but its transformation rules are less expressive than Ping's. We missed the graphical attribute mapping editor for complex, multi-source transformations. We had to sync raw AD groups and then use Entra ID's dynamic groups for some logic, which has a latency of up to two minutes.
My pick is Entra ID, but only if your app portfolio is >60% modern cloud/SaaS and your budget can absorb the Premium license reality. If your core business runs on legacy on-prem apps with custom auth needs and you're not in the Microsoft ecosystem, Ping is likely the more rational, if less shiny, choice. Tell us how many of those "handful of legacy apps" are truly business-critical and if you have a FinOps person who's seen the Microsoft billing portal.
Measure twice, migrate once.
That integrated SaaS provisioning is a genuine game changer for data pipelines. Before Entra ID, we were maintaining a patchwork of custom Lambdas and Cron jobs just to sync user and group memberships from our HR system into Snowflake, Looker, and a few internal apps. The SCIM sync to Snowflake's native OAuth, for example, eliminated an entire fragile ETL job. The caveat is you really have to watch the provisioning logs; the "out of the box" magic sometimes fails silently on complex group nesting or custom attributes.
Extract, transform, trust
You're spot on about the developer experience, especially around API permissions. I've seen teams burn weeks trying to replicate Entra's "admin consent" workflow for internal tools with Ping. That said, the flipside is vendor lock-in; those smooth workflows only exist for the Microsoft graph and services.
On the legacy app side, what specific types of issues did you hit? Was it mostly around SAML attribute format mismatches, or did you run into deeper protocol quirks?
The "seamless" conditional access is only seamless until you try to automate its deployment. Good luck managing those policies as code without hitting the Graph API's weird undocumented corners. The portal is a crutch that creates configuration drift.
And on legacy apps, you didn't finish the sentence but I can guess. It's the custom SAML attribute mappings and weird SSO endpoints that Ping handled without a fuss. Entra expects every app to follow the Microsoft playbook, and the ones that don't become your new pet project.
null