# Ping Identity MCP for AI Agents AI Agent Connect > Ping Identity lets you manage your PingOne environment using your AI client. You can audit users, check risk policies, and manage application permissions without leaving your chat window. It turns complex identity and access management into a conversation, making it easier to keep your enterprise secure. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_ZxqgWh604I1POHOOcxBrHLwtrQ4rx2I1kp1TS0HB/ai-agent-connect - **Tags:** sso, mfa, zero-trust, iam, user-provisioning, authentication, authorization ## Description Managing enterprise identities usually feels like a chore of clicking through endless tabs and nested menus. If you're trying to figure out who has access to what, or why a specific user is getting blocked by MFA, you're likely jumping between the PingOne console and various spreadsheets. This Connector changes that by letting your AI agent do the heavy lifting. Instead of manually hunting for a group or checking a risk policy, you just ask your agent to find the data. You can see how your populations are partitioned, review your sign-on flows, and even handle user deletions in seconds. It puts your entire identity posture into a single conversational interface. Because Vinkius hosts this Connector, you can plug it into your existing workflow and start querying your security settings immediately. It's about moving from manual data hunting to proactive management, where your agent handles the navigation while you make the decisions. ## Tools ### delete_user Removes a user identity and wipes all related credentials and session tokens. This ensures a clean removal from the directory. ### list_groups Lists the identity groups used for aggregate permissions across your SSO channels. Use this to map out RBAC scopes. ### get_group Displays the explicit details for a specific Ping Identity group. Use this to see exact membership and rules. ### get_user Retrieves the complete contextual metadata for a specific user in your directory. It's great for quick profile lookups. ### list_applications Lists all Web, Native, or SPA apps federated under your PingOne environment. This helps you see your full app footprint. ### list_populations Shows the isolated populations for contractors, partners, or B2B clients. Use this to check segment isolation. ### list_users Lists all user identities within your standard PingOne environment. This is your go-to for directory-wide audits. ### list_risk_policies Lists the active Risk Management rules that dictate your real-time MFA prompts. Use this to audit your security logic. ### list_sign_on_policies Lists the logical sign-on flows and authentication conditions for your environment. Use this to review your sign-on rules. ### get_application Shows the configuration for a single federated application, including its sign-on policies. It helps verify callback URIs. ## Prompt Examples **Prompt:** ``` Show me all the apps we have in PingOne and tell me if any of them use insecure protocols. ``` **Response:** ``` You currently have 12 federated applications. | App Name | Grant Type | Callback URI | | :--- | :--- | :--- | | Internal CRM | Auth Code | `https://crm.company.com/callback` | | Legacy Portal | Implicit | `http://legacy.portal.com` | **Security Note:** The 'Legacy Portal' is using an insecure `http` protocol for its callback URI. I recommend updating this to `https` to maintain your Zero-Trust posture. ``` **Prompt:** ``` What are our current risk policies for blocking logins? ``` **Response:** ``` I've pulled the active Risk Management rules for your environment: * **Impossible Travel:** Triggers MFA if a login occurs from two distant locations in a short timeframe. * **Anonymous Networks:** Blocks all attempts from known VPN or TOR exit nodes. * **Behavioral Anomalies:** Uses machine learning to flag logins that deviate from the user's typical pattern. Would you like me to drill down into the specific conditions for any of these? ``` **Prompt:** ``` I need to delete user 81773-XYZ-192. Can you make sure all their sessions are gone too? ``` **Response:** ``` I have successfully executed the deletion for user `81773-XYZ-192`. **Actions completed:** * Identity profile removed from the Directory. * All active session tokens revoked. * Application scopes nullified. * SCIM references isolated. The user is now completely disconnected from all federated services. ``` ## Capabilities ### Audit user identities See who's in your directory and what their metadata looks like. ### Remove user access Delete identities and wipe their active sessions or app scopes. ### Check app permissions View the specific grants and callback URIs for federated apps. ### Review risk rules See the logic behind your MFA prompts and login blocks. ### Map identity groups List the high-level roles and permissions across your SSO. ### Partition populations View how contractors and partners are isolated from internal users. ## Use Cases ### Audit insecure apps A security engineer asks the agent to list all applications and find any using insecure callback protocols using list_applications. ### Fast offboarding An IT admin asks the agent to delete a specific user profile and confirm all sessions are gone using delete_user. ### Policy review A security lead asks the agent to show all active risk policies to check for impossible travel rules using list_risk_policies. ### Access verification An IAM admin asks the agent to list the groups for a specific user to see their aggregate permissions using list_groups. ## Benefits - Faster Audits: Use list_users and list_applications to get a full view of your security footprint in seconds rather than clicking through pages. - Rapid Troubleshooting: Use get_user to grab metadata instantly when a user reports a login issue, cutting down your ticket response time. - Precise Deletions: Use delete_user to ensure a user's identity and all associated session tokens are wiped completely from the directory. - Risk Visibility: Use list_risk_policies to see exactly which rules are triggering MFA prompts for your different user populations. - Population Management: Use list_populations to verify that contractors and partners are properly isolated from your core enterprise data. ## How It Works The bottom line is you get a conversational interface for your entire PingOne identity infrastructure. 1. Connect your PingOne Environment ID and API Token to the Connector. 2. Ask your AI client to perform a specific task, like listing all active users. 3. Receive a structured summary of the data or a confirmation of the action taken. ## Frequently Asked Questions **Can I use Ping Identity MCP to manage my SSO users?** Yes, you can use it to list all user identities, fetch specific user metadata, and handle user deletions through a conversational interface. **How does Ping Identity MCP help with MFA security?** It allows you to query and review your active risk policies and sign-on flows in real time, helping you understand what triggers MFA prompts. **Can I audit my applications using Ping Identity MCP?** You can list all federated Web, Native, and SPA applications and retrieve specific configuration details like grant types and callback URIs. **Does Ping Identity MCP help with user offboarding?** It makes offboarding faster by allowing your AI agent to delete user identities and automatically revoke all associated sessions and permissions. **Can I see our risk policies through Ping Identity MCP?** Yes, the Connector can list all active Risk Management rules, including those for impossible travel, anonymous networks, and behavioral anomalies. **Can I check which groups a user belongs to with Ping Identity MCP?** You can use the Connector to list identity groups and check the specific details of groups to verify user permissions across your SSO. **Can my AI automatically detect insecure applications federated under my PingOne Environment?** Yes. Ask the agent to list all applications and their OIDC/SAML parameters. It will return grant types and callback URIs. You can instruct your AI to identify any applications exposing excessive grants, lacking mandatory PKCE, or missing secure redirection URLs. **Can I use the agent to investigate complex zero-trust policies?** Absolutely. Query the agent for your current Risk Policies and Sign-On Policies. The AI translates raw rulesets (like IP anomalies, VPN blocklists, or ML-based behavioral steps) into human-readable summaries, letting you track how authentication flows operate without reverse-engineering JSON files. **How does the agent organize directories inside PingOne?** The agent can separate users utilizing Ping Identity's native Population boundaries and abstract mapping Groups. You can list all Populations to see distinct buckets entirely independent of each other, enforcing different self-service and strict password compliance boundaries globally across your organization.