Flexible, developer-friendly CIAM

• Descope is multi-tenant by design and can support advanced B2B enterprise requirements. Tenants can easily be created and managed from the console or Management SDK.

• Easily control session management, password settings, and permission controls at a tenant level.

• With PingFederate, control session management and password settings at a tenant level.

• Permission controls are complicated to implement at a tenant level in the Ping Dashboard, but can be done programmatically.

• Strong support for both SAML and OIDC SSO with full self-service configuration. 

• Use identity federation to unify customer identities across all business-facing apps.

• Create custom onboarding journeys for each app.

Dynamic behaviour, including real-time IdP routing and passing tenant context into the SSO decision, is assembled in DaVinci flows, inheriting DaVinci's separate licence and expertise requirement.

Descope’s SSO self-service flows allow your customers to easily set up their app with their own IdPs.

No self service provisioning supported. Customers must interact with Ping Identity admins in order to correctly configure SSO.

No-code workflows to create and customize flows such as user invites, step-up auth, user merging, and identity orchestration.

• Non-workflow based approach to user authentication, much less flexible in developing user journeys.

• DaVinci exists as an add-on that does support creating workflows, but at an additional cost and requires additional implementation work.

Self-service, embeddable widgets for a variety of end user actions: user and role mgmt, access key mgmt, audits, and user profiles.

• Delegated admin lives in Ping's hosted pages and admin console. It is not embeddable.

• Enabling your customers with tenant-level administration inside your own product means building it against the APIs.

With Flows and connectors, you can easily create branching user paths based on risk scores ingested from 3rd-party fraud services like reCAPTCHA.

• Bot Detection and Suspicious Device require upgrading from a legacy PingOne Risk licence to Protect

• Most predictors need a training period and learn only from successful events.

• Add fine-grained and tenant-aware authorization (RBAC, ReBAC, ABAC) capabilities to your app. 

• Utilize custom JWT claims to define access controls for your app.

• Assign user roles and permissions based on workflow conditions.

• Add fine-grained and tenant-aware authorization (RBAC and ReBAC) capabilities to your app. 

• Unable to assign user roles and permissions based on workflow conditions.

• Automated or on-demand user provisioning and deprovisioning.  

• Integrations with major IAM systems ensure synchronization of user data across systems.

• Self service SCIM provisioning with access key widget.

SCIM API caps responses at 200 resources with no pagination, collapses several standard multi-valued attributes to one value, cannot clear an attribute once set, and is recommended for outbound only. Setup is also never customer self-service.