What is the difference between SP- and IdP-Initiated SSO?

The primary difference is where the login flow begins: at Procore (Service Provider) or at your Identity Provider's portal (IdP). Procore supports both methods:

• Service Provider Initiated (SP-initiated) SSO. The login process begins at the Procore login page. When a user enters their email address, Procore redirects them to your Identity Provider (such as Microsoft Entra ID, Okta, or OneLogin) for authentication. Once verified, the user is automatically redirected back to Procore and logged in.

• Identity Provider Initiated (IdP-initiated) SSO. The login process begins inside your Identity Provider portal. Users sign into their organization’s SSO dashboard (such as Okta or Microsoft Entra ID) and click the Procore application tile. The identity provider authenticates the user and launches them directly into Procore.