Hey everyone, I've been lurking for a bit but this is my first real post here, so please be gentle 😅
Our company is in a weird transition phase. We have a bunch of legacy apps on-prem (think old Java stuff and file servers) and we're moving a lot of newer things to Azure, including some SaaS apps. We're using Azure AD for the cloud side already, but the on-prem stuff needs a bridge. The team managing our old PingFederate setup is saying we should just upgrade and extend it, but our security lead is pushing hard for PingOne, saying it's the "modern" way.
My question is: for those who've actually lived through this, which one ends up being less painful for a hybrid setup like ours? I'm not a deep IAM expert, I mostly deal with getting our project management and CRM tools hooked into whatever identity system we pick.
Specific things I'm worried about:
* How much custom connector work is still needed with PingOne for on-prem things?
* Is the administration for a hybrid environment genuinely easier in one over the other?
* We have to roll out MFA everywhere soon. Does one make that journey smoother when you're split between cloud and on-prem?
I've read the datasheets, but they're... not super helpful for the real-world messy stuff. Any stories or gotchas would be hugely appreciated!
I'm a marketing tech manager at a mid-sized retail company (around 3,000 users) where I own all the customer-facing app integrations, and we've been running a hybrid Azure/on-prem setup for years, moving from PingFederate to PingOne about 18 months ago.
- **Hybrid Connector "Tax":** PingFederate wins for pure on-prem legacy. Its built-in agents and adapter SDKs for things like Java web apps or Apache mean less custom work for old systems. With PingOne, you'll still need PingFederate or a third-party gateway for many non-standard on-prem apps. We had to keep one PingFederate node (about $15k in annual maintenance) as a bridge, which the initial sales conversation didn't highlight.
- **Admin Experience Split:** PingOne's cloud admin console is far simpler for Azure/SaaS app configurations (OIDC, SAML). But for a hybrid setup, you now have two places to administer: PingOne portal for cloud, and still a separate console (PingFed or your gateway) for on-prem connectors. The "single pane" promise only works if everything is cloud-ready.
- **MFA Rollout Path:** PingOne makes cloud-side MFA push-button easy. For on-prem apps using the hybrid bridge, MFA policies flow down, but the user experience can get clunky (extra redirects). The total project was smoother with PingOne because we could enforce modern auth on the cloud side immediately, but the tail-end work for the last 10% of on-prem apps was longer.
- **Real Cost & Effort:** PingFederate feels like a capital expense (we paid ~$50k upfront + 22% annual maintenance) with more internal admin labor. PingOne is an operational cost (~$6/user/month for our tier) with less day-to-day admin, but you trade that for ongoing subscription fees and potential hidden hybrid bridging costs. The migration itself took us 9 months of part-time effort.
Given your mix and the fact you're already in Azure AD, I'd recommend PingOne, but only if your team is prepared to budget for and manage a hybrid bridge component for at least 3-5 years. If your "bunch of legacy apps" is more than 30% of your total, or you can't get funding for that bridge, the path of least resistance is actually the upgraded PingFederate. To decide cleanly, tell us the ratio of cloud-ready vs. truly legacy on-prem apps, and if your security lead owns the budget for the bridging piece.
test everything twice
You're right to zero in on the custom connector work. That's the hidden time sink. For PingOne, our team still wrote a fair bit of custom code for a few truly ancient on-prem web apps, basically little proxies that could talk to the cloud. If you have "file servers" and old Java in the mix, that's a red flag for expecting a pure cloud identity service to just work.
On the MFA point, PingOne made that part easier for us for the cloud apps, no question. But for the legacy stuff, it was the same old story - we had to deploy PingFed's MFA adapters anyway. So we ended up managing MFA in two places. The "smoother journey" promise only applies if your on-prem footprint is shrinking fast.
Honestly, if your team already knows PingFederate and the legacy apps aren't going away soon, upgrading might be the *less* glamorous but more pragmatic path. The security lead's push for "modern" is understandable, but modern doesn't always mean less pain for hybrid.
ship it