# Connecting SailPoint and Workday To connect SailPoint with Workday, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 7. Select **Save**. ## Connection Settings Provide the information required to connect to the Workday source. [Basic Authentication](<#basic-authentication>) and [OAuth 2.0 Authentication](<#oauth-20-authentication>) types are supported. ### Basic Authentication > [!NOTE] > > **Screenshot** > > [![Basic Authentication connection settings]()]() 1. Enter the **Workday URL** that is used to connect to the Human Resource module of Workday. Use the following URL format: `https://wd2-impl-services1.workday.com/ccx/service/tenant1/Human_Resources`, where `tenant1` is the Workday tenant name. > **Note** > > The Workday source only supports the Human Resource module of Workday. 2. Select **Basic** as the Authentication Type. 3. Provide the following details for the Basic Authentication Type: - **Service Account** - The Workday account with required permissions. The account must be in this format: `@` - **Service Account Password** - The password that belongs to the service account. 4. Select **Save**. ### OAuth 2.0 Authentication > [!NOTE] > > **Screenshot** > > [![OAuth 2.0 authentication connection settings]()]() > [!NOTE] > > **Screenshot** > > [![OAuth 2.0 authentication connection settings, continued]()]() 1. Enter the **Workday URL** that is used to connect to the Human Resource module of Workday. Use the following URL format: `https://wd2-impl-services1.workday.com/ccx/service/tenant1/Human_Resources`, where `tenant1` is the Workday tenant name. > **Note** > > The Workday source only supports the Human Resource module of Workday. 2. Select **OAuth 2.0** as the Authentication Type. 3. Provide the following details for the Refresh Token Grant Type: - **Client ID** - Workday API client ID. - **Client Secret** - Workday API client secret. - **Refresh Token** - Non-expiry Workday API refresh token. - **Token URL** - The URL for token generation. For example, `https://{yourDomain}/oauth2/v1/token`. 4. Select **Save**. ## Aggregation Settings This section provides the details required for aggregating the user accounts. Refer to [Loading Account Data]() for more information about aggregation. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() > [!NOTE] > > **Screenshot** > > [![Aggregation Settings, continued]()]() 1. Select **Exclude Contingent Workers** to only aggregate full-time workers in aggregation. 2. In the **Integration System ID** field, enter the System ID of the Integration System to fetch custom or calculated attributes. 3. In Future Offset, enter the number of days in advance of their hire date to aggregate future workers. 4. In Termination Offset, enter the number of days in the past you want to aggregate terminated workers. 5. Enter any **Future Hire Events** that prompt the connector to include a future worker into account aggregation. For example, Onboarding or Contract Contingent Worker. Provide the event into the field and press Enter to add it to a growing list. 6. Enter any **Future Termination Events** that prompt the connector to include a terminated worker into account aggregation. For example, Terminate Employee or End Contingent Worker. Provide the event into the field and press Enter to add it to a growing list. 7. In Rescinded Offset, enter the number of days (in the past) to aggregate rescinded hires. To fetch the rescinded past hires data for a worker, their hire date must be in the Past Rescinded Offset range. 8. Select **Aggregate Rescinded Future Hires** to include accounts with future-dated hire dates. Rescinded workers whose hire dates have yet to pass, yet are within the configured Rescinded Offset range, are included in account aggregation. 9. Select **Aggregate Pre-Hires** to aggregate Pre-Hires ahead of their start date. 10. In Page Size, enter the number of account records to aggregate in a single page when iterating over large datasets. 11. Enter the value in **Effective Time Zone** that has the location and the time zone based on how the HR data (Hire, Termination, Re-hire, Conversion) is processed. Default: UTC. > **Note** > > SailPoint recommends the use of the Effective Time Zone parameter during aggregation to avoid account issues. For example, if the Workday server is in the PST time zone then enter the America/Los\_Angeles time zone in this field. All tz database timezone are supported. The following examples are supported valid timezones for Effective Time Zone: - America/New\_York - America/Los\_Angeles - America/Chicago 12. Configure the Account Filters to define the scope of account aggregation based on the workers' organization or eligibility criteria. For more information, refer to [Account Filters](<#account-filters>). 13. Select **Save**. ### Account Filters The Workday connector supports account aggregation filters using Organization Type and **Eligibility Criteria**. You can modify the filters per your requirements. For more information, refer to [Support for Filtering Using Eligibility Criteria](). > [!NOTE] > > **Screenshot** > > [![Account Filters on the Aggregation Settings page]()]() The following are examples of Account Filters that can be added on the **Aggregation Settings** page: 1. Enable the option to **Aggregate Workers by Organization**, and select one of the following from the **Organization Filter Type** dropdown: - **Organization Type** - Select the **Organization Type** option to filter the account based on the organization type. For example, `COST_CENTER`, `SUPERVISORY`. - **Organization Reference ID** - Select the **Organization Reference ID** option to filter the workers' records based on organization. 2. Enable the option to **Aggregate Workers by Eligibility Criteria**, and enter the following fields: - **Integration Fields** - Enter the integration service fields to aggregate workers based on the fields entered, and press Enter to add each individual entry. - **Integration Field Override Service** - Provide the Integration Field Override Service name. ### Delta Aggregation Settings This section provides the details required for delta aggregation. > [!NOTE] > > **Screenshot** > > [![Delta Aggregation Settings]()]() 1. Enable **Delta Aggregation** if you want to aggregate accounts that have changed since the last aggregation process. 2. In Past Effective Date Offset, enter the number of days in the past the connector should look for back-dated delta aggregation events. 3. Enter **Delta Aggregation Events**, to prompt the connector to include workers into account aggregation. 4. Enable **Delta Aggregation Lite Events** to include Event Lite records in delta aggregation. 5. Enter **Event Lite Types** to specify the Event Lite types the connector includes in delta account aggregation. > **Note** > > Workday Event Lite is a lightweight record in the transaction log that tracks system updates without starting a full business process. > **Screenshot** > > [![Event Lite Types]()]() 6. Select **Save**. ### Response Group Mapping The Workday connector supports response group filters beyond the default response values. > [!NOTE] > > **Screenshot** > > [![Response Group Mapping]()]() 1. Select **Add Another** for each response group you want to add. 2. Add the Response Group, and provide the Value for the response group. 3. Select **Save** after you have added all the response groups. ### XPath Schema Mapping The default Workday connector includes XPaths for all default business processes. If you must aggregate future data and future actions for a different business process, you must define the new XPaths for that business process. > [!NOTE] > > If you add the XPaths for a new business process, you must provide all XPaths for all business processes. This must include the defaults along with the new XPaths. > [!NOTE] > > **Screenshot** > > [![XPath Schema Mapping]()]() 1. Select **Add Another** for each attribute you want to add. 2. Add the Schema Attribute, and provide the XPath for the attribute. 3. Select **Save** after you have added all the attributes. ## Provisioning Settings Provide the attributes to use for provisioning. This information is not required for your connection. > [!NOTE] > > **Screenshot** > > [![Provisioning Settings]()]() > [!NOTE] > > **Screenshot** > > [![Provisioning Settings, continued]()]() > [!NOTE] > > **Screenshot** > > [![Provisioning Settings, continued]()]() 1. Provide the attributes to use for the Primary Home Phone Type and **Primary Work Phone Type**. For example, specify landline or mobile. 2. Provide the country code to use for the phone attributes. 3. Define the Phone Device Type along with the associated **Reference ID** as required. > **Note** > > If the Phone Device Type value is anything other than `telephone`, `pager`, `fax`, or `mobile`, you need to identify the Reference ID and map it in the UI. For example, if the phone device type for `telephone` is defined on your Workday tenant system as `landline`, find the Reference ID for `landline` and enter it in place of `telephone`. > > To find the Reference ID: > > - Go to your Workday tenant and search for the Maintain Reference IDs task. > - Select the **Business Object Type** as `Phone Device Types`, and then select **None of the above**. > - Select **OK**, and the **Reference ID** values of the Phone Device Type ID are listed. 4. Choose whether you want to delete phone or email records by selecting the following checkboxes: - **Delete All Phone Records** - **Delete All Email Records** 5. Enter any **Custom Attribute** along with its associated custom object for provisioning in Custom Object-Attribute Associations. The associations must be entered in the following format: `custom_object.custom_attribute`. 6. Enter the **REST API Endpoint** that SailPoint requires to update the Custom Attribute. 7. Select **Bypass Provisioning Approvals** to bypass the approval process on provisioning requests and automatically process changes. 8. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation.