Configure SP-Initiated SSO for Procore in Azure AD (2024)

Note

If your organization isusing the Portfolio Financials and Capital Planning products in Procore, you will need to reach out to your Procore point of contact or theSupport team to set up your Azure AD SSO.

You will need to provide the following information when requesting the setup: Single Sign On Issuer URL, Single Sign On Target URL (Optional for IdP-Initiated SSO), and Single Sign On x509 Certificate.

Step 1: Add Procore as a New Enterprise Application in Azure AD

1. Log in to the Azure AD portal as a Global Administrator: http://portal.azure.com

   
   

   See Also

   Enable single sign-on for an enterprise application - Microsoft Entra ID

2. Under Favorites, clickAzure Active Directory.
3. Under Manage, click Enterprise Applications.
4. Click +New Application.
5. Under Add from the Gallery, type the following in the Enter a Name box: Procore
6. Click the matching application namedProcore.
   This reveals a new pane.
7. In the Name box, typea name for your application.
   Note: In the example above, we named our application: Procore (Demo)
8. ClickAdd.
   A message appears to confirm that the application was added successfully. You should now be viewing your newProcoreenterprise application'sOverview page.

Step 2: Configure the ProcoreEnterprise Application's SSO Settings

1. In the Overview page for your new enterprise application, under Manage, click Single Sign-On.

   
   

2. In the Single Sign-on Modepage, click SAML.
   This opens theSet Up Single Sign-On with SAML- Preview page.
3. Under Basic SAML Configuration, clickEdit.
   This opens the Basic SAML Configuration window.
4. Under the Basic SAML Configuration page, do the following:
   • Identifier (Entity ID)
     Change the value from:https://app.procore.com to:https://login.procore.com
     Note:If you are using Portfolio Financials and Capital Planning, enter the following value instead:https://www.honestbuildings.com/pfcp/app/#!/login
     

     Optional - Unique Entity ID

     When configuring SSO for a singleProcore instance, you should NOT check this box.

     If your company licensesmore than one Procore instance, and you wantto configure unique Procore enterprise applications within your IdP tenant for each instance, you can by enablingUnique Entity ID. If enabled, youare still limited to one (1) enterprise application per Procore company instance.

     Important:SSO for Procore targets users by email domain.An email domain can only be targeted once in all of Procore, so if you're considering setting upSSO with Unique Entity IDs acrossmultiple Procore instances, remember that you can only target an email domain once, in a singleinstance.

     To generate a Unique Entity ID for an enterprise application, check theEnableUnique Entity IDbox in the Procore Admin tool's SSOconfiguration page for the Procoreinstance you want to specify on anenterprise application. Checking this boxwill generate a uniqueEntity ID URL in the field below, which you will then copy and paste into theappropriate Entity ID field in your IdP'sconfiguration page.

     Notes: You must save your configuration with the box checked to generate the Unique Entity ID. Enabling this feature does not impact user membership or access to a given instance. Access to a company in Procore is determined by a user's presence in the Directory tool, and their configured permissions within Procore. Auto-provisioning with SSO is not supported at this time.

     

   • Sign On URL
     Leave this field blank. You do NOT need to enter a value in this field.
   • Reply URL (Assertion Consumer ServiceURL)
     Enter the following:https://login.procore.com/saml/consume
5. Click Save.
   A message appears to confirm that your settings were saved successfully.
6. Click the 'x' to closethe Basic SAML Configurationpage.
7. UnderSAML Signing Certificate, click the Download link for the Certificate (Base64) file.
   Notes:
   • This downloads a file named PublicCertificate.cer to your browser's specified download area.
   • Open the file in a text editor and leave it open on your computer. Later, you will copy the code that appears between the ---BEGIN CERTIFICATE--- and ---END CERTIFICATE-- tags into Procore.

     

Step 3: Add the Azure AD Settings to Procore'sCompany Level Admin Tool

1. Leave the Azure AD page open as described in the previous step.
2. Log into Procoreusing your Procore Administrator account.
3. Navigate to the Company levelAdmintool.
4. UnderCompany Settings, clickSingle Sign On Configuration.
5. Leave Procore's'Single Sign On Configuration' page open.
6. Go to the Azure AD page that you left open.
7. Under Set Up [Your Application Name], click View Step-by-Step Instructions.
   This opens the Configure Sign-On page.
   

   Copy this information from Azure AD…	Paste it into this field in Procore…
   SAML Entity ID Copy the URL in this field from Azure AD.	Single Sign On Issuer URL Paste the SAMLEntity IDURL into the Single Sign On Issuer URL field.
   SAML Single Sign-On Service URL Copy the URL in this field from Azure AD.	Single Sign On Target URL Paste the SAML Single Sign-On ServiceURL into the Single Sign On Target URLfield.
   SAML XML Metadata Download this file to your computer and open it in a text editor (i.e., Notepad or Text/Edit). Locate the certificate data that appears between the HTML start and end tags for the x509 certificate. Then copy the data. Do NOT copy the tags. This isdepicted in the animated image above: Start Tag: <X509Data><X509Certificate> End Tag: </X509Data></X509Certificate>	Single Sign On x509 Certificate Paste the certificate data you copied into this field.

   
   
8. On the 'Single Sign On Configuration' page in Procore, click Save Changes.
9. Reach out to Procore Support or your company'sProcore point of contact to requestthey configure the email domain(s) you'd like to target for SSO.
10. After you receive confirmation that the SSOconfiguration is ready, mark the Enable Single Sign On checkbox on the 'Single Sign On Configuration' page.
11. Select the Service Provider Forward option.
12. Click Save Changes.