Configure IdP-Initiated SSO for Microsoft Entra ID

If your company manages your users with Microsoft Entra ID, you can leverage its SSO capabilities. This gives your end users the ability to authenticate their identify for the Procore application using their Microsoft Entra ID account. With this SSO integration, you can:

• Leverage Microsoft Entra ID for SSO access to Procore.

• Simplify your entire organization's password management process.

• Avoid problematic user password management.

• Authentication Protocol:

  • You can integrate the Procore application with Microsoft Entra ID using the Security Assertion Markup Language (SAML 2.0).

• Requirements:

  • Microsoft Entra ID

• Required Permissions:

  • Global Administrator rights to Microsoft Entra ID.

  • 'Admin' level permissions to the Company Admin tool.

Step 1: Add Procore as an Enterprise App in Microsoft Entra ID

1. Log in to the Microsoft Entra Admin Center: https://entra.microsoft.com

2. In the left panel, expand Entra ID.

3. Click Enterprise apps.

4. At the top of the page, click +New Application.

5. In the Search application box, type: Procore

6. Click Procore app's tile. This opens the Procore Enterprise app details in the right panel.

7. In the Name box, type a name for your company's Procore Enterprise app.

8. Click Create.

A notification confirms the application was created, and you directed to your new Procore Enterprise application's Overview page.

Step 2: Configure the Procore Enterprise App's SSO Settings

1. In the left navigation menu for the Procore Enterprise application, under Manage, select Single sign-on.
   

2. In the Select a single sign-on method page, select SAML to open the Set Up Single Sign-On with SAML page for editing.

3. In the Basic SAML Configuration card, click Edit.

4. Update these fields:

   • Identifier (Entity ID):

     • Change the value from: https://app.procore.com

     • Change the value to: https://login.procore.com


       Note: Values for Portfolio Financials and Capital Planning

       If you are using Portfolio Financials and Capital Planning:

       • Change the value from: https://www.honestbuildings.com/pfcp/app/#!/login

       • Change the value to: https://login.procore.com

   • Reply URL (Assertion Consumer Service URL):

     • Enter the following: https://login.procore.com/saml/consume

   • Sign On URL:

     • Leave this field blank. You do NOT need to enter a value in this field.

5. Click Save. A message confirms your updates were saved.

6. Close the Basic SAML Configuration page.

7. Under SAML Signing Certificate, click the Download link for the Certificate (Base64) file.

This downloads a file named PublicCertificate.cer to your downloads folder. Open the file in a text editor and leave it open. Later, you will copy the code between the ---BEGIN CERTIFICATE--- and ---END CERTIFICATE--- tags into Procore.

Step 3: Assign Users and Groups to the Procore Enterprise App

1. In the Overview page for your new enterprise application, under Manage, click Users and groups.

2. Click +Add user/group from the top menu.

3. On the Add Assignment page, under Users, select None Selected.

4. Search for and select the users or groups to whom you will grant access to Procore. The selected names will appear under the Selected items list.

5. Click Select at the bottom of the page.
   

   Tip

   Want to test the integration before deploying it to your end users? If so, add only your own user account. After completing the configuration steps and testing the integration, return to this section to assign the rest of your organization's users to Procore.

6. Under Select a role, select None Selected, choose an appropriate role (if applicable), and click Select.

7. Click the Assign button at the bottom left of the page to finalize the assignment.

Step 4: Add the Microsoft Entra ID Settings to Procore

1. Log in to the Procore web application.
   

   Important

   You must log in using a Procore account with 'Admin' level permissions on the Company level Admin tool

2. Navigate to the Company Admin tool.

3. Under Company Settings, click Single Sign On Configuration.

4. Enter the following information:

   • Single Sign-On Issuer URL: Paste the Microsoft Entra Identifier copied from the Microsoft Entra ID portal.

   • Single Sign-On Target URL: Paste the Login URL copied from Microsoft Entra ID. Although optional for IdP-initiated flows, completing this field simplifies any future transition to SP-initiated SSO.

   • Single Sign-On x509 Certificate: Paste the base64 certificate text downloaded from the Microsoft Entra IDportal.
     

     Important

     Do NOT copy the ------------BEGIN CERTIFICATE------------ and ------------END CERTIFICATE------------ header and footer lines. Copy only the encoded text string between them.

5. Click Update.

6. Contact your Procore point of contactor Contact Support to request the addition of the domain(s) you want to target for SSO authentication. Procore must enter these domains on your behalf into the Single Sign-On Domain(s) field.

7. Once Procore adds your domain(s), return to the Single Sign On Configuration page, place a checkmark in the Enable Single Sign-On box at the top, and click Update to finalize and enable SSO.