# Connecting SailPoint and Workday To connect SailPoint with Workday, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Select **Save**. ## Connection Settings Provide the information required to connect to the Workday source. [Basic Authentication](<#basic-authentication>) and [OAuth 2.0 Authentication](<#oauth-20-authentication>) types are supported. ### Basic Authentication > [!NOTE] > > **Screenshot** > > [![Basic Authentication connection settings]()]() 1. Enter the **Workday URL** that is used to connect to the Human Resource module of Workday. Use the following URL format: `https://wd2-impl-services1.workday.com/ccx/service/tenant1/Human_Resources`, where `tenant1` is the Workday tenant name. > **Note** > > The Workday source only supports the Human Resource module of Workday. 2. Select **Basic** as the Authentication Type. 3. Provide the following details for the Basic Authentication Type: - **Service Account** - The Workday account with required permissions. The account must be in this format: `@` - **Password** - The password that belongs to the service account. - **Provisioning Administrator** - The name of the provisioning administrator having permission to update the Workday account. - **Provisioning Administrator Password** - The password of the provisioning administrator with update permission. #### REST Client API Configuration For Basic authentication, enable the **REST API** option to perform the provisioning operation on custom objects. > [!NOTE] > > **Screenshot** > > [![REST Client API configuration settings]()]() 1. Enter the **REST API Endpoint** of the Workday server. For example, `https://WORKDAY_HOST/ccx/api/v1/TENANT_NAME` 2. In Token Endpoint, enter the Workday token API endpoint. For example, `https://WORKDAY_HOST/ccx/oauth2/TENANT_NAME/token` > **Note** > > The values of the REST API Endpoint and Token Endpoint can be obtained from the **View API Clients** report in the Workday application. 3. Enter the Workday API **Client ID** and **Client Secret**. 4. Enter the Workday API **Refresh Token**. > **Note** > > Ensure that the token never expires. ### OAuth 2.0 Authentication > [!NOTE] > > **Screenshot** > > [![OAuth 2.0 authentication connection settings]()]() 1. Enter the **Workday URL** that is used to connect to the Human Resource module of Workday. Use the following URL format: `https://wd2-impl-services1.workday.com/ccx/service/tenant1/Human_Resources`, where `tenant1` is the Workday tenant name. > **Note** > > The Workday source only supports the Human Resource module of Workday. 2. Select **OAuth 2.0** as the Authentication Type. 3. Provide the following details for the Refresh Token Grant Type: - **Client ID** - Workday API client ID. - **Client Secret** - Workday API client secret. - **Refresh Token** - Non-expiry Workday API refresh token. > **Note** > > To use OAuth 2.0 authentication in preexisting sources, update the source XML with `connector_key="encrypted" value="refreshTokenDummy,clientSecretDummy,oauth_token_info"` using the SailPoint REST API. - **REST API Endpoint** - The REST API Endpoint of the Workday server. For example, `https://WORKDAY_HOST/ccx/api/v1/TENANT_NAME`. ### Connection Parameters > [!NOTE] > > **Screenshot** > > [![Connection parameters]()]() 1. Enter the value for **Page Size** to fetch the number of records during aggregation in a single call (Limit 1 to 999). Default: 100. 2. Enter the **Connection Timeout** value in minutes. Default: 1 minute. 3. Enter the number of the **Aggregation Thread Size**. The default value is 4 (this is the maximum number of threads). You can set it to a lower value (for example, 2 or 3) depending on the system load. This parallel aggregation improves performance by reducing the time required to finish aggregation. The Workday source aggregates the active and terminated accounts. 4. Enter the value in **Effective Time Zone** that has the location and the time zone based on how the HR data (Hire, Termination, Re-hire, Conversion) is processed. Default: UTC. > **Note** > > SailPoint recommends the use of the Effective Time Zone parameter during aggregation to avoid account issues. For example, if the Workday server is in the PST time zone then enter the America/Los Angeles time zone in this field. The following examples are supported valid timezones for Effective Time Zone: - America/New\_York - America/Los\_Angeles - America/Chicago - PST - HST - Asia/Dubai - CET - GMT - ACT - Australia/Melbourne ## Aggregation Settings This section provides the details required for aggregating the user accounts. Refer to [Loading Account Data]() for more information about aggregation. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() 1. Select **Delta Aggregation** to configure the delta aggregation parameters. 2. Enter the **Past Effective Date Offset** value to aggregate an account using delta aggregation that has been back-dated. For example, account details such as a termination date that has been set prior to the last aggregation. 3. Enter the **Delta Aggregation Events** list, which is used when performing delta aggregation. **Filter Settings** > [!NOTE] > > **Screenshot** > > [![Filter Settings]()]() > [!NOTE] > > **Screenshot** > > [![Filter Settings, continued]()]() 1. Select **Exclude Future Terminating Records** to skip future termination records during aggregation. > **Note** > > Selecting this option removes the values for the following attributes: Future action, Future Date, Last day of work, and Termination date. 2. Select **Aggregate Pre-Hires** to aggregate Pre-Hires ahead of their start date. 3. Select **Aggregate Rescinded Past Hires** to retain information for the rescinded past hires to support leaver workflows. 4. In Past Rescinded Offset, enter the number of days (in the past) to aggregate rescinded hires. Default: 60 days. To fetch the rescinded past hires data for a worker, their hire date must be in the **Past Rescinded Offset** range. 5. Select **Aggregate Rescinded Future Hires** to fetch information for the rescinded future hire Workday workers to support leaver workflows. 6. In Effective Date Offset, enter the number of days in advance to aggregate future hires and terminations. For example, enter 14 to aggregate Workday workers 14 days in advance of their hire date. > **Note** > > - If the Effective Date Offset is set as 0 (zero), the connector does not aggregate future hires and terminations. > - SailPoint recommends that you perform a full aggregation if the Effective Date Offset is changed. For more information, refer to [Future Dated Workers](). 7. Enter the **Organization Reference IDs** to filter the workers' records based on organization. The Organization Reference IDs can be found as follows: 1. Search for the required organization. 2. Hover over the action and then select **Integration ID**. 3. Select **View IDs** and note the ID mentioned in front of the organization type. 8. In Integration System ID, provide the System ID of the Integration System to fetch custom or calculated attributes. 9. Provide the Integration Field Override Service name. 10. In Integration Field(s), enter the integration service fields (with multiple fields separated by a comma) to aggregate workers based on the mentioned filter conditions. 11. The Past Termination Offset field determines the offset value in days, which indicates the number of past days to aggregate terminated workers based on their termination date. Default: 60 days. Use the following values for the offset: - 0 - aggregates all terminated workers - Blank - defaults the offset to 60 days - Any positive value - aggregates terminated workers within a specific number of days > **Note** > > For more information on support for filtering using eligibility criteria, refer to [Support for Filtering Using Eligibility Criteria](). 12. Specify the Future Hire Events to include, such as Onboarding or Contract Contingent Worker, by entering the name of the event and selecting **Enter**. You can add multiple events. Default: Hire Employee, Onboarding, Contract Contingent Worker. 13. Specify Future Termination Events to include, such as Terminate Employee or End Contingent Worker Contract, by entering the name of the event and selecting **Enter**. You can add multiple events. Default: Terminate Employee, End Contingent Worker Contract. 14. Add Termination Attributes that are included for future terminated workers, such as Termination\_Date or Contract End Date, by entering the attribute name and clicking **Enter**. You can add multiple attributes. Default: `TERMINATION_DATE`, `LAST_DAY_OF_WORK`, `CONTRACT_END_DATE`, `PRIMARY_TERMINATION_REASON_REFERENCE`. 15. To fetch terminated workers up to the aggregation date, specify Termination Events, such as Terminate Employee or End Contingent Worker Contract, by entering the event name and clicking **Enter**. You can add multiple attributes. Default: Terminate Employee, End Contingent Worker Contract. 16. Select **Fetch Workers By Organization** to fetch workers based on the organization type. When **Exclude Terminated Worker** is selected, Workday uses the default `COST_CENTER` **Organization Type**. To change the default, enter the organization type. 17. Select **Save**. ### XPath Schema Mapping The Workday source provides support to aggregate fields in addition to the fields present in the default account schema in the user interface. This option was previously only available using an API. > [!NOTE] > > The Workday connector reads the data using the Workday SOAP API and fetches the required attribute as per Account Schema by parsing the XML response. For efficient parsing, the connector requires the namespace to be provided using `ns1:`. The default Workday connector includes XPaths for all default business processes. If you must aggregate future data and future actions for a different business process, you must define the new XPaths for that business process. > [!NOTE] > > If you add the XPaths for a new business process, you must provide all XPaths for all business processes. This must include the defaults along with the new XPaths. > [!NOTE] > > **Screenshot** > > [![XPath Schema Mapping]()]() 1. Select **Add Another** for each attribute you want to add. 2. Add the Schema Attribute, and provide the XPath for the attribute. 3. Select **Save** after you have added all the attributes. ## Provisioning Settings Provide the attributes to use for provisioning. This information is not required for your connection. > [!NOTE] > > **Screenshot** > > [![Provisioning Settings]()]() 1. Provide the attributes to use for the Primary Home Phone Type and **Primary Work Phone Type**. 2. Provide the country code to use for the phone attributes. 3. Update the contact information by enabling Use Change Contact Info API. This option is only available when using API version 30.1 and later. 4. If the Use Change Contact Info API option is enabled, choose whether you want to delete phone or email records by selecting the following checkboxes: - **Delete All Phone Records** - **Delete All Email Records** 5. Select **Bypass Provisioning Approvals** to bypass the approval process on provisioning requests and automatically process changes. 6. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation.