Content-Security-Policy: frame-ancestors 'self' app.procore.com us02.procore.com support.procore.com edgeservices.bing.com www.bing.com www.staging-bing-int.com copilot.microsoft.com microsoftonline.com sharepoint-df.com sharepoint.com sharepointonline.com spgrid.com spolabs.com spoppe.com sposites.com partner.microsoftonline.cn sharepoint.cn sharepoint.de myus.msftsptest.com my.microsoftpersonalcontentppe.com wopi.onedrive.com wopi.onedrive-tst.com outlook.office.com outlook-sdf.office.com outlook.live.com outlook-sdf.live.com outlook-tdf.live.com sdfpilot.live.com outlook.office365.us outlook.office365.com exchangelabs.live-int.com office-int.com officeapps.live-int.com officeapps.live.com *.officeapps-df.live.com *.cloud.microsoft *.datagrid.com fa000000125.resources.office.net fa000000129.resources.office.net fa000000124.resources.office.net fa000000128.resources.office.net; default-src 'self' https:; connect-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data: *.omtrdc.net www.googletagmanager.com; object-src 'none'; script-src 'self' https: 'unsafe-inline' assets.adobedtm.com *.omtrdc.net https://www.googletagmanager.com https://connect.facebook.net/ https://snap.licdn.com; style-src 'self' https: 'unsafe-inline'; upgrade-insecure-requests