Okta → PingOne

Migrate SSO applications from Okta to PingOne in hours, not months.

TenantFlex reads every SAML and OIDC application in your Okta org, maps its claims to PingOne's own form, and recreates it in the PingOne environment with an execution log and a hand-off bundle for each owner. The Okta side is read-only throughout.

Request a demo

Microsoft Entra IDOktaPingOneadditional IdPs on request

Okta → PingOne · in production

What moves

Saml 2.0 and oidc applications, recreated as SAML and OIDC applications.

SAML

Entity ID, reply and sign-on URLs, NameID format and the attribute statements. A new signing certificate is generated on the PingOne side; the application owner installs it at cutover.

OIDC and OAuth

Redirect URIs, grant types, scopes and API permissions. Client secrets are generated on the PingOne side and handed to the owner once, never copied.

Reported, not moved

User and group assignments, conditional access or sign-on policies, and SCIM provisioning are read and shown in discovery so the owner can recreate them deliberately. SCIM migration is on the roadmap.

How it works

Discover, review, migrate.

Discover

Connect an identity provider tenant in read-only. TenantFlex inventories its SAML and OAuth/OIDC applications, service principals, credentials and their expiry. You see what is really there, not what the CMDB says.

Review

Approve what is in scope, set naming and credential handling, and get suggestions for complex claims transformations. Nothing migrates until it is approved.

Migrate and hand off

Each application is recreated in the target tenant, read back and compared with the source, then handed to its owner for cutover. If one fails, the job rolls back what it created.

Claims

Okta writes `${user.email}`. PingOne expects `email (attribute mapping)`.

Each provider's claims are translated to one shared vocabulary, the central TenantFlex profile vocabulary, and written back in the destination's own format. Claims that map to a standard user attribute migrate automatically. Claims that use transformations, expressions or attributes the destination does not have are reported as complex in discovery, so they are reviewed before anything moves. Custom claims can be mapped to destination claims for a whole job or for a single application.

At cutover

TenantFlex provides a handover bundle per migrated application. For a SAML application: the identity provider login URL, the identity provider identifier and the signing certificate, all of which are in the destination's federation metadata. For an OIDC application: the client ID, the client secret and the issuer URL. Until the owner makes the change, users keep signing in through the source tenant, so each application can be cut over on its own schedule, aligned with your change management processes and maintenance windows.

How long it takes

Recreating an application in the destination takes minutes. Most of the elapsed time in a tenant migration is cutover coordination with application owners, so a plan is usually built back from a date: discovery about three months ahead, a pilot wave, then the remaining waves as scheduled jobs.

Same provider on both sides?

Yes. The destination can be any connected tenant, including one at the same provider: Entra ID to Entra ID after an acquisition, or Okta org to Okta org when two business units consolidate. The naming template keeps the migrated applications distinguishable from the originals.

Permissions for this pair

Read-only on Okta. Write only on PingOne.

Okta · source

Read applicationsokta.apps.read

Lists applications with their sign-on mode, SAML and OIDC configuration, assignments and signing certificates. The API client also needs an administrator role that can read applications.

Optionalokta.appGrants.read
Only so an OAuth application's API permissions are read rather than reported as unknown.
Never needed on the source
No write permission is asked for on the org you are leaving.

PingOne · destination

Create applicationsClient Application Developer

Creates applications and writes their configuration.

Read back after each write
Every setting is read back from PingOne and compared with the source. A failed application is rolled back.

The full list, including the optional scopes for discovery features, is in the permissions reference.

Permissions reference →How it works

Other pairsEntra ID → Okta Entra ID → PingOne Okta → Entra ID Okta → PingOne PingOne → Entra ID PingOne → Okta

Pricing

Pay for the applications you move, or hand the whole thing to us.

Licensed per application in scope. Discovery tells you the number before you commit.

Two ways to engage.Take the platform, or take the platform and the people.

Licensed per application

You license the platform by the applications in scope, not by user count or tenant size. Discovery tells you that number before you commit. SaaS or deployed in your own environment, the same release either way.

Self-service

White-glove migration

We run it with you: scoping, the claim and policy decisions that need a human, a cutover plan per application, and the hand-off to each application owner. You get the platform and the practitioners who have done these migrations by hand.

With consultancy

Standby and the privileged access review are priced separately.

Pricing →

Get started

Bring your Okta to PingOne migration to TenantFlex.

Tell us roughly how many applications are in the org and what is driving the move. We will walk you through a live migration, read-only on Okta throughout.

[email protected] · www.tenantflex.com