PingFed vs. PingOne - which is less painful for a hybrid Azure/on-prem setup?

That's a great analogy with the dashboard. So the "unified" view is really just showing the first leg of a two-leg journey. If the user provisioning breaks on the second leg, the console gives you a green checkmark for the first one, which sends you looking in the wrong place.

I'm learning about this split setup. Does that mean you end up building your own internal runbook to always check the PingFed bridge first for a certain class of errors, because the PingOne console can't be trusted for them?

Yes, that's exactly what happens. You end up creating an internal checklist that starts with "Ignore the PingOne console success status for a minute, go check the PingFed audit logs." It adds a mandatory, manual step to every triage process.

But the hidden cost is the operational drift. When a new team member joins, you'll train them on the unified console first. The first few times they get burned by its false positive, they'll learn the internal runbook. But that institutional knowledge is brittle. It's a silent tax on onboarding and a risk during outages.