Payments Admin Guide

• Why does Procore Pay require MFA?

• How does MFA work?

• Which Procore Pay users are required to log in with MFA?

• Which one-time password applications are compatible with Procore Pay?

• What are the MFA account lockout settings?

• When are Procore Pay users challenged by MFA?

• Are MFA login attempts recorded?

• Is MFA required when testing the Payments tool in our company's Sandbox?

• What happens if I lose or replace the device where MFA is configured?

• How do Procore Pay users troubleshoot user issues with MFA?

Why does Procore Pay require MFA?

To help safeguard your most sensitive operations from unauthorized account access, Procore Pay requires users to complete a multi-step account login process. This process is called Multi-Factor Authentication (MFA). MFA is required for Procore Pay, regardless of whether or not you are using Pay to move money.

How does MFA work?

Pour fournir à Procore Pay une méthode fiable pour protéger les informations sensibles des comptes bancaires et les transactions de paiement, il est important que les clients de Procore Pay s’assurent que leur environnement dispose de solides protections de gestion des mots de passe. Pour garantir que vos opérations les plus sensibles sont protégées contre tout accès non autorisé au compte, les utilisateurs de Procore Pay doivent effectuer un processus de connexion de compte multifacteur pour authentifier leur identité.

Ces facteurs sont les suivants :

• Saisissez votre adresse e-mail et votre mot de passe pour votre compte utilisateur Procore. Si vous êtes un utilisateur autorisé disposant d’une autorisation d’accès à Procore Pay, vous serez invité à saisir votre nom d’utilisateur et votre mot de passe sur la page de connexion de Procore.

• Saisissez un code de mot de passe à usage unique généré par une application MFA sur un appareil mobile. Ensuite, un code de mot de passe à usage unique basé sur le temps (TOTP) est envoyé à votre appareil mobile. Un code TOTP est un code secret généré de manière aléatoire et affiché sur l’appareil mobile d’un utilisateur à l’aide d’une application compatible TOTP.

Which Procore Pay users are required to log in with MFA?

Authorized users who have been granted role-based permissions to the Company level Payments tool are required to log in using MFA before accessing the Company level Payments tool AND before performing secure financial operations.

The table below details the roles and requirements for MFA:

Which one-time password applications are compatible with Procore Pay?

Procore Pay has tested two applications that can be used in your company's environment: Google Authenticator and Auth0 Guardian. However, other TOTP-compliant applications can also be used, such as Microsoft Authenticator.

The application used in your company's environment is likely determined either by your company's owner and/or your IT department. Procore has tested these TOTP apps for compatibility with Procore Pay:

• Auth0 Guardian App

• Google Authenticator

What are the MFA account lockout settings?

To prevent repeated MFA login attempts as part of an attack, designated Procore Pay users are subject to these account lockout settings:

• Number of failed login attempts to trigger account lockout: 10 (TOTP)
  Notes:

  • Procore lockout settings configured in the Company level Admin tool do NOT apply with MFA enabled.

  • If you are locked out of your account, contact Payment Operations to request an MFA reset.

When are Procore Pay Users challenged by MFA?

Your company's authorized Payments Admins and the Payments Disbursers designated by your Payments Admin are required to complete an MFA challenge every time they perform one of these actions in the Procore web application:

• Log in to your company's account in the Procore web application.

• Navigate to the Company level Payments tool.

• Creating or submitting a disbursement:

  • If using Procore Pay to send payments without the Workflows tool, before a Payments Disburser creates a disbursement in the Payments tool.

  • If using Procore Pay with the Workflows tool, before the designated Workflow Approver submits a disbursement.

• When the Company level Payments tool is idle for more than 30 minutes in a user session.
  
  Note: Procore Pay users are required to complete an MFA challenge at login, regardless of whether or not they are using Pay to move money.

Are MFA login attempts recorded?

Yes. Every attempted MFA login and its outcome is logged. Records are retained in the log for six (6) years.

Is MFA required when testing the Payments tool in our company's sandbox account?

Procore Pay is not available in your company's Sandbox account.

What happens if I lose or replace the device where MFA is configured?

If you lose or replace your mobile device, you’ll need to restore access to your authenticator app. MFA must be reset to restore access after losing or damaging a device. Some device types and authenticator apps might also require an MFA reset to restore access after intentionally replacing a device. Contact Payment Operations if you need to have MFA reset so you can log into Procore Pay.

How do I troubleshoot user issues with MFA?

Below are tips for troubleshooting common issues with MFA as a Procore Pay user.