SSO/MFA Integration with PingFederate and PingOne

[SkyHai]

Any Ping users here?

I've been tasked with implementing SSO and MFA with PingFederate and PingOne via SAML. I initially recommended the Ping’s Provisioning Connector for Looker, but it was ruled out by upper brass due to the fact it’s, not certified or maintained by Ping, and introduces another third party. This effectively left SAML as the only option.

I have a few questions:

1. Should I configure SAML in PingOne, PingFederate, or both? Ultimately AD is where the users are stored and therefore the source of truth, but I'd like to leverage Ping as much as possible since it's more secure than a simple LDAP passthrough
2. For the smoothest user experience, should I specify SP-initiated login in the SAML settings?