PingOne Authorize

Short Summary

Digital services have shifted customer behavior and expanded the amount of sensitive data shared across organizations, increasing both cyberattack exposure and regulatory pressure to provide secure, auditable access across many applications and directories. Access control therefore becomes central to cybersecurity and compliance, but many organizations still rely on Role-Based Access Control (RBAC), which requires frequent manual role changes when employees change jobs or leave. RBAC role models also demand major rework during organizational change and often fail to reflect real customer-data scenarios that are governed by consents, entitlements, and relationships rather than static roles.

Policy-Based Access Control (PBAC) is positioned as a more flexible alternative because policies share a consistent structure—Subject, Action, Resource, Context—and can be updated centrally and applied immediately to large user populations. PBAC supports fine-grained, context-aware decisions using attributes such as job title, file type, time of day, location, and risk score, enabling consistent entitlements across legacy systems, cloud platforms, IaaS, and multi-cloud. Authorization decisions are externalized and delivered to enforcement points such as authentication systems, API gateways, applications, or internally developed digital services, with APIs serving as a natural integration point. PBAC is also aligned with Zero Trust by continuously verifying access using predefined policies and contextual controls.

The report reviews Ping Identity’s PingOne Authorize, a SaaS offering (also available on-premises as PingAuthorize) that converges PingAccess and PingAuthorize capabilities. PingOne Authorize provides dynamic authorization and API access management, supported by a Trust Framework for defining assets, services, users, and policy entities. Strengths include fine-grained ABAC, integration with the broader PingOne portfolio and major API gateways, delegated administration, orchestration, and modern dashboards. Challenges include limited hybrid support (roadmapped), package-based feature limitations, and constrained integration with legacy applications.

Interesting Facts

• Data regulation laws in many regions require organizations to provide secure user access to customer data distributed across multiple applications and directories.
• RBAC commonly requires IAM teams to manually adjust access rights when employees change jobs or leave.
• PBAC policies use the structure Subject, Action, Resource, Context.
• PBAC policies can incorporate attributes such as job title, file type, time of day, access location, and risk score.
• Policy Enforcement Points can include authentication systems, API gateways, applications, or internally developed digital services.
• Ping Identity was founded in 2002 and is headquartered in Denver, United States.
• Ping Identity has around 1,400 employees.
• Ping Identity entered a definitive agreement to be acquired by Thoma Bravo for approximately $2.8 billion in August 2022.
• Ping Identity provides integrations with over 1,800 applications, services, and APIs.
• PingOne Authorize launched in late 2021 and remains available on-premises as PingAuthorize.

Notable Quotes

• “Access control is a key component of cybersecurity processes that enables organizations to manage who is authorized to access which data and resources.”
• “Customer data use cases don’t tend to fit cleanly into roles; instead, access to customer data is managed by consents, entitlements and relationships…”
• “Unlike roles, policies are easier to define, and they all have the same structure: Subject, Action, Resource, Context.”
• “A strong access management system is essential for embracing a Zero-Trust approach.”
• “This aligns with one of the core principles of Zero-Trust, ‘Don’t trust. Verify!’.”
• “Modern applications are built on APIs, which provide a perfect hook to extend access control with PBAC capabilities without changing the application.”
• “Externalizing authorization eliminates the need for code modifications and application downtime when stakeholders and developers make changes to policies.”
• “Dynamic authorization delivers fine-grained and context-aware authorization based on policies.”
• “By controlling what end users can see and do inside of applications and APIs, PingOne Authorize delivers a fine-grained, cloud-based dynamic authorization…”
• “The Trust Framework is where an organization-wide view of data and service ecosystem is found.”