Troubleshooting

Account aggregation completes successfully but returns no accounts from Workday.

The integration user may lack the required domain security policy permissions, even if all documented permissions have been assigned.

Resolution: Ask the customer’s Workday administrator to verify and configure the following permissions:

1. In Workday, search for Domain Security Policies for Functional Area.

2. Select Staffing and go to Worker Data: Workers.

3. Under the Integration permission section, verify that the SailPoint security group is listed.

   • If the security group is not present, add it to the Integration permission section.

4. Run the Activate Pending Security Policy Changes task.

5. Verify that the issue is resolved.

During entitlement aggregation in the Workday Accounts Connector, you may encounter one of the following issues:

• Aggregation completes successfully, but the SECURITY_GROUPS attribute is not returned.

• Aggregation fails with the following error:

  Copy

   invalid request: WQL error.",
   "errors":[{"error":"Enter a valid report field. This field is invalid: cf_SecurityGroupName.",
   "field":"cf_SecurityGroupName",
   "location":"Invalid SELECT clause"

Resolution : Check with your Workday team to verify and correct the configuration by following these steps:

1. In the search bar, enter Edit Calculated Field.

2. Search for Security Group Name form the list of Calculated Field.

3. Under the Additional Info section, verify that the WQL Alias Name is set exactly as follows: cf_SecurityGroupName

   Note
   The alias is case-sensitive and must be entered exactly as shown

4. If the WQL alias is incorrect or missing, update it accordingly.

5. Save the changes and re-run the entitlement aggregation.

Resolution: This is a limitation of the Workday API, where multiple provisioning requests containing different entitlements cannot be processed simultaneously. As a workaround, customers should include all required entitlements within a single provisioning request.

Resolution: The Create Account policy must include values for username, filenumber, and worker-type. If any of these values are missing, the operation will fail with the error mentioned above.