Services / Migration Services
We Have Migrated Over 100 Million Identities to PingOne. Your Migration Is in Good Hands.
Migration is the most complex, highest-stakes engagement in identity. You are moving the authentication and access infrastructure on which every user in your organization — or every customer of your business — depends. Get it wrong and you face production outages, data loss, application failures, and the kind of incident that becomes a case study in how not to run an identity program.
ISG has executed migrations of this type at a scale that very few firms in the identity industry have encountered. More than 100 million user identities migrated to PingOne. Thousands of re-federated applications. Zero-downtime cutovers in production environments serving tens of millions of active users. We have done this work for major airlines, banks, insurers, retailers, global insurance companies, pharmaceutical and consumer healthcare and B2B — across North America, Europe, Asia-Pacific, and Latin America.
We are not learning migration on your program. We have already learned it — in environments considerably more complex than most.
Migration Paths We Deliver
Okta / Auth0 → PingOne
One of the most common migrations ISG delivers. We handle Okta application inventory and classification, policy translation, user and group migration (including data cleansing and reconciliation), Okta Workflows → DaVinci translation, application re-federation for SAML/OIDC/OAuth2 integrations, phased cutover with rollback capability at every stage, and structured Okta tenant decommission once migration is validated.Microsoft Entra / Azure AD B2C → PingOne
We handle Azure AD B2C custom policy analysis (decomposing IEF XML policies into DaVinci flows), Entra External ID → PingOne CIAM migration, user data migration including password hash migration where supported, Microsoft Graph integration maintenance during and after migration, and application re-registration from Azure AD to PingOne application configurations. Custom policies in Azure AD B2C are particularly complex — we re-architect for the DaVinci model rather than attempting literal translation.Legacy Platform → Ping (Oracle, CA, IBM, Siteminder)
ISG has executed migrations from Oracle Identity Federation, CA SSO (Siteminder), IBM Security Access Manager, and similar legacy platforms to Ping Identity. These are often the most complex migrations because legacy platforms frequently have undocumented integrations, years of accumulated customization, and application dependencies that were never formally recorded. Our approach places particular emphasis on discovery and inventory — ensuring that nothing is missed before cutover begins.ForgeRock On-Premises → PingOne Advanced Identity Cloud (AIC
ISG’s team knows ForgeRock on-premises deeply — we built on it before it became AIC. We handle AM Tree → AIC Journey migration (including re-engineering for trees using custom scripting or nodes not supported natively in AIC), IDM configuration migration, DS data migration from on-premises DS/OpenDJ to AIC Directory Services, custom script remediation (Groovy and JavaScript), and integration re-pointing from on-premises AM/IDM endpoints to AIC equivalents.Legacy On-Premises Ping → PingOne Cloud
The on-premises Ping model and the PingOne cloud model differ in fundamental architectural ways — a lift-and-shift approach does not work. ISG handles architecture re-design mapping PingFederate adapter stacks and connection configurations to PingOne equivalents, application migration re-federating from PingFederate to PingOne, PingAccess → PingOne / Ping Authorize migration, PingDirectory data migration including schema transformation and data cleansing, and PingOne Advanced Services for organizations needing cloud delivery with dedicated infrastructure.The ISG Migration Methodology
PingOne · PingOne Advanced Identity Cloud (AIC) · PingOne DaVinci · PingFederate · PingAccess · PingDirectory · PingOne Advanced Services · PingOne Protect · PingOne MFA · PingID · Ping Authorize
PingOne · PingOne Advanced Identity Cloud (AIC) · PingOne DaVinci · PingFederate · PingAccess · PingDirectory · PingOne Advanced Services · PingOne Protect · PingOne MFA · PingID · Ping Authorize