Skip to main content
Procore

What is a Developer Managed Service Account?

For developers building applications using data connection components we recommend leveraging the new Developer Managed Service Accounts (DMSA) feature as a streamlined approach to providing Procore administrators the ability to easily install and provision data connection applications in their company accounts. The DMSA feature allows developers to specify the exact company and project level tool permissions that are required for their application to run properly on the Procore platform. Company administrators define which projects the application can access using those permissions. Developers utilize DMSAs to provide a more convenient and secure alternative to traditional service accounts. Company administrators benefit from DMSAs through improved application management and better visibility into application usage.

 deprecation of traditional Service Accounts
Traditional Service Accounts will be deprecated on December 9, 2021. Creation of new traditional service accounts will no longer be allowed after July 31, 2022. All traditional service accounts will be sunset on January 31, 2023. As a result of this deprecation, developers of data connection applications that currently use traditional service accounts must migrate the app to use DMSAs, and customers must install these migrated apps before the January 31, 2023 sunset date. See Deprecation of Traditional Service Accounts for more details.

How does a DMSA differ from a traditional service account?

Here are some of the primary differences between DMSAs and traditional service accounts.

  Developer Managed Service Account Traditional Service Account
Account Creation
  • A directory user associated with the DMSA is automatically created in the Company and/or Project Directory tool.
  • A traditional service account must be created and managed manually by a company administrator.
Authorization
  • A single set of credentials (client_id, client_secret) is used to access all companies where the application is installed.
  • Each service account created in a company by an administrator has a unique set of credentials, requiring manual coordination with the developer for successful integration.
Permissions
  • Required permissions are defined by the developer in the application manifest and automatically applied during installation.
  • Permissions for each service account must be configured manually by a company administrator.
Project Configuration
  • During installation, you can select which projects the DMSA application is allowed to run in. Once the application is installed, you can add or remove permitted projects as needed.
  • Project access and must be configured and managed manually by the company administrator.
App Management
  • DMSA-enabled applications are easily installed from the App Marketplace or as a custom install. Company Admin tool (App Management) used for uninstall/reinstall.
  • All aspects of traditional service account installation and management must be handled manually by a company administrator.

What will I see in my account after installing an application that uses a DMSA?

During the installation process, a new user record may be created in the Company and/or Project Directory tool that represents the DMSA. The DMSA contact name follows a distinct format with the application name converted to lower case and separated by dashes followed by an eight-character randomly generated id. For example, installing the application My DMSA Test App would create the user my-dmsa-test-app-469b1f7f in the Company Directory.

 Warning
Do not edit or delete users created by DMSA application installations as this may cause problems with the operation of the application.