Project management platforms accumulate access the way job trailers accumulate tools. A superintendent needs admin rights for one urgent project. A subcontractor's project engineer leaves, but their login stays. A consultant gets added to a project and never removed. After a few years, nobody can say with confidence who can see which drawings, budgets and contracts.
This matters for security and for business reasons. Project platforms hold cost data, bid information, contracts, RFIs and sometimes sensitive facility drawings. Overly broad access increases the risk from a compromised password and the risk of simple mistakes, such as someone editing a budget they should only view. This guide uses Procore as the example, but the same principles apply to other construction software.
Start with a company-level review
Begin at the account level, not project by project.
- Export or list all company users and their roles.
- Identify who holds administrator permissions at the company level. This group should be small, usually a few named people.
- Flag accounts with no recent activity.
- Flag users with personal email addresses, shared mailboxes, or generic names like "office" or "estimating."
Shared accounts are a particular problem. When five people use one login, you lose accountability, and you cannot remove one person's access without affecting the others.
Use permission templates deliberately
Most platforms let you define permission templates by job function. Instead of adjusting access one person at a time, create templates that match how your company works.
- Executive or owner view: read access to financials and reports, no routine editing.
- Project manager: full access to their projects' cost, contract and change event tools.
- Superintendent or foreman: daily logs, inspections, photos, punch lists and drawings, with limited access to cost.
- Accounting: the financial tools they need and nothing about field operations they do not touch.
- Subcontractors and vendors: minimal access limited to their scope, ideally only the tools they must use.
Review each template against a simple rule: what is the least access this role needs to do the job well?
Handle external users with care
Subcontractors, owners' representatives, architects and engineers often need access. Treat their accounts as temporary by default.
- Add them to specific projects, not the whole company.
- Limit them to the tools relevant to their work.
- Require multi-factor authentication where the platform supports it.
- Set a review date at project closeout or at a regular interval, and remove access when the work ends.
If an outside user's email account is compromised, an attacker may have a legitimate login to your platform. Narrow access limits what they can see.
Tie access to onboarding and offboarding
Permissions drift because nobody owns the process. Add the project platform to your employee checklists.
- When someone is hired or changes roles, assign the matching template, not a copy of a coworker's access.
- When someone leaves, disable their account the same day. Do not wait for the next audit.
- When a project closes, remove temporary users and archive access.
Turn on the protections you already pay for
Check the account's security settings. Look for single sign-on with your identity provider, multi-factor authentication requirements, session timeouts, and activity or audit logs. If your platform integrates with Microsoft 365, single sign-on lets you disable one account and cut off several systems at once.
A quarterly routine that takes an hour
- Review company administrators.
- Review users inactive for a defined period and disable or remove them.
- Review external users on closed or inactive projects.
- Spot-check one or two templates against current job duties.
- Record the date and who performed the review.
Support from Ironfield Cyber
Ironfield Cyber supports construction software environments, including identity and access settings for project and accounting platforms. If you would like a second set of eyes on your user list and permission structure, we can walk through it with your operations and accounting leads.