Connecting SailPoint and Workday

To connect SailPoint with Workday, perform the following tasks:

Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

To configure a new source:

1. Sign in to SailPoint.
2. Go to Admin > Connections > Sources.
3. Select Create New.
4. Search for the connector by entering the name in the search box, and then select Actions.

5. In the Actions dropdown list, select the setup method:

   • Express Setup - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     Note

     Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to Credential Providers. For more information, contact your SailPoint Customer Service Manager.

   • Standard Setup - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select Start Express Setup.

2. Review the pre-populated Source Name, Source Owner, and Description. To update, select Edit.

   Note

   The source name must be unique. You can change these settings later in the source configuration.

3. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a Credential Provider in SailPoint, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the Connection Settings section.

5. Select Finish.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   • If you want to aggregate now, select Aggregate.

     • To see the latest account aggregation history, go to Account Management > Account Aggregation.
     • To see the list of aggregated source accounts, go to Account Management > Accounts.

   • If you want to aggregate later, select Exit. This returns you to the Sources page. Your new source is listed, but contains no accounts or aggregation history yet.

Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the Source Name field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the Description field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the Source Owner field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to Assigning a Source Owner.
4. (Optional) Select a governance group to grant its members source or role sub-admin level oversight of the source and its access. For more information, refer to Creating and Managing Governance Groups.
5. If this source represents a primary system containing your organization's personnel records, select the Authoritative Source checkbox. For more information, refer to Creating Identity Profiles.
6. Select Continue. The source is created, and you are navigated to the Source Setup > Base Configuration page. Continue to configure your connected source there.

Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.

2. In the Source Owner dropdown list, select the identity that owns this source.

   • To find a source owner, begin entering their name.

3. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a credential provider, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

4. Configure the authentication to allow SailPoint to connect to the source. Refer to Connection Settings for more information.

5. (Optional) In the Governance Group for Source Management dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to Associating Governance Groups with a Source.

6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   • Enable Provisioning - Set the toggle to Enabled to allow the source to create, update, and deactivate accounts in the connected source system.

   • Disable Provisioning - Set the toggle to Disabled to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.

7. Select Save.

Connection Settings

Provide the information required to connect to the Workday source. Basic Authentication and OAuth 2.0 Authentication types are supported.

Basic Authentication

1. Enter the Workday URL that is used to connect to the Human Resource module of Workday. Use the following URL format: https://wd2-impl-services1.workday.com/ccx/service/tenant1/Human_Resources, where tenant1 is the Workday tenant name.

   Note

   The Workday source only supports the Human Resource module of Workday.

2. Select Basic as the Authentication Type.

3. Provide the following details for the Basic Authentication Type:

   • Service Account - The Workday account with required permissions. The account must be in this format: <username>@<tenantname>

   • Service Account Password - The password that belongs to the service account.

4. Select Save.

OAuth 2.0 Authentication

1. Enter the Workday URL that is used to connect to the Human Resource module of Workday. Use the following URL format: https://wd2-impl-services1.workday.com/ccx/service/tenant1/Human_Resources, where tenant1 is the Workday tenant name.

   Note

   The Workday source only supports the Human Resource module of Workday.

2. Select OAuth 2.0 as the Authentication Type.

3. Provide the following details for the Refresh Token Grant Type:

   • Client ID - Workday API client ID.
   • Client Secret - Workday API client secret.

   • Refresh Token - Non-expiry Workday API refresh token.

   • Token URL - The URL for token generation. For example, https://{yourDomain}/oauth2/v1/token.

4. Select Save.

Aggregation Settings

This section provides the details required for aggregating the user accounts.

Refer to Loading Account Data for more information about aggregation.

1. Select Exclude Contingent Workers to only aggregate full-time workers in aggregation.
2. In the Integration System ID field, enter the System ID of the Integration System to fetch custom or calculated attributes.
3. In Future Offset, enter the number of days in advance of their hire date to aggregate future workers.
4. In Termination Offset, enter the number of days in the past you want to aggregate terminated workers.
5. Enter any Future Hire Events that prompt the connector to include a future worker into account aggregation. For example, Onboarding or Contract Contingent Worker. Provide the event into the field and press Enter to add it to a growing list.
6. Enter any Future Termination Events that prompt the connector to include a terminated worker into account aggregation. For example, Terminate Employee or End Contingent Worker. Provide the event into the field and press Enter to add it to a growing list.
7. In Rescinded Offset, enter the number of days (in the past) to aggregate rescinded hires. To fetch the rescinded past hires data for a worker, their hire date must be in the Past Rescinded Offset range.
8. Select Aggregate Rescinded Future Hires to include accounts with future-dated hire dates. Rescinded workers whose hire dates have yet to pass, yet are within the configured Rescinded Offset range, are included in account aggregation.
9. Select Aggregate Pre-Hires to aggregate Pre-Hires ahead of their start date.
10. In Page Size, enter the number of account records to aggregate in a single page when iterating over large datasets.

11. Enter the value in Effective Time Zone that has the location and the time zone based on how the HR data (Hire, Termination, Re-hire, Conversion) is processed. Default: UTC.

    Note

    SailPoint recommends the use of the Effective Time Zone parameter during aggregation to avoid account issues. For example, if the Workday server is in the PST time zone then enter the America/Los_Angeles time zone in this field.

    All tz database timezone are supported. The following examples are supported valid timezones for Effective Time Zone:

    • America/New_York
    • America/Los_Angeles
    • America/Chicago

12. Configure the Account Filters to define the scope of account aggregation based on the workers' organization or eligibility criteria. For more information, refer to Account Filters.

13. Select Save.

Account Filters

The Workday connector supports account aggregation filters using Organization Type and Eligibility Criteria. You can modify the filters per your requirements. For more information, refer to Support for Filtering Using Eligibility Criteria.

The following are examples of Account Filters that can be added on the Aggregation Settings page:

1. Enable the option to Aggregate Workers by Organization, and select one of the following from the Organization Filter Type dropdown:

   • Organization Type - Select the Organization Type option to filter the account based on the organization type. For example, COST_CENTER, SUPERVISORY.
   • Organization Reference ID - Select the Organization Reference ID option to filter the workers' records based on organization.

2. Enable the option to Aggregate Workers by Eligibility Criteria, and enter the following fields:

   • Integration Fields - Enter the integration service fields to aggregate workers based on the fields entered, and press Enter to add each individual entry.
   • Integration Field Override Service - Provide the Integration Field Override Service name.

Delta Aggregation Settings

This section provides the details required for delta aggregation.

1. Enable Delta Aggregation if you want to aggregate accounts that have changed since the last aggregation process.
2. In Past Effective Date Offset, enter the number of days in the past the connector should look for back-dated delta aggregation events.
3. Enter Delta Aggregation Events, to prompt the connector to include workers into account aggregation.
4. Enable Delta Aggregation Lite Events to include Event Lite records in delta aggregation.

5. Enter Event Lite Types to specify the Event Lite types the connector includes in delta account aggregation.

   Note

   Workday Event Lite is a lightweight record in the transaction log that tracks system updates without starting a full business process.

   Screenshot

   

6. Select Save.

Response Group Mapping

The Workday connector supports response group filters beyond the default response values.

1. Select Add Another for each response group you want to add.
2. Add the Response Group, and provide the Value for the response group.
3. Select Save after you have added all the response groups.

XPath Schema Mapping

The default Workday connector includes XPaths for all default business processes. If you must aggregate future data and future actions for a different business process, you must define the new XPaths for that business process.

1. Select Add Another for each attribute you want to add.
2. Add the Schema Attribute, and provide the XPath for the attribute.
3. Select Save after you have added all the attributes.

Provisioning Settings

Provide the attributes to use for provisioning. This information is not required for your connection.

1. Provide the attributes to use for the Primary Home Phone Type and Primary Work Phone Type.

   For example, specify landline or mobile.

2. Provide the country code to use for the phone attributes.

3. Define the Phone Device Type along with the associated Reference ID as required.

   Note

   If the Phone Device Type value is anything other than telephone, pager, fax, or mobile, you need to identify the Reference ID and map it in the UI. For example, if the phone device type for telephone is defined on your Workday tenant system as landline, find the Reference ID for landline and enter it in place of telephone.

   To find the Reference ID:

   • Go to your Workday tenant and search for the Maintain Reference IDs task.
   • Select the Business Object Type as Phone Device Types, and then select None of the above.
   • Select OK, and the Reference ID values of the Phone Device Type ID are listed.

4. Choose whether you want to delete phone or email records by selecting the following checkboxes:

   • Delete All Phone Records
   • Delete All Email Records

5. Enter any Custom Attribute along with its associated custom object for provisioning in Custom Object-Attribute Associations. The associations must be entered in the following format: custom_object.custom_attribute.

6. Enter the REST API Endpoint that SailPoint requires to update the Custom Attribute.

7. Select Bypass Provisioning Approvals to bypass the approval process on provisioning requests and automatically process changes.

8. Select Save.

Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to Review and Test.

2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.

3. Select Test Connection.

SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to Discovered Applications in the SailPoint user interface.

For more information, refer to Application Onboarding in the SailPoint SaaS documentation.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.