# Integrating SailPoint with Workday Accounts SaaS This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a Workday Accounts SaaS connector in SailPoint. Connecting SailPoint to your Workday Accounts SaaS connector allows you to aggregate Workday Account records from Workday and enable/disable the Workday Accounts. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The SailPoint Workday Accounts SaaS connector supports the following features. The following table specifies which kind of authentication is required for each supported feature: | Supported Features | Basic Authentication | OAuth 2 Authentication | | --- | --- | --- | | Manage Active, Terminated, Future Accounts | Yes | Yes | | Filter Accounts by Organization | Yes | Yes | | Manage Service Center Representative Accounts | Yes | Yes | | Manage Extended Enterprise Learner Accounts | Yes | Yes | | Manage Implementers Accounts | No | Yes | | Manage Integration System Accounts | No | Yes | | Manage Workday Accounts for Students | No | Yes | | Manage Additional Group Schema Attributes | No | Yes | | Aggregation of User-based security groups | Yes (Partial) - the `COMMENT` and `DESCRIPTOR` attributes are only supported for the OAuth 2.0 Authentication Type | Yes | | Aggregation of Organization roles as Group Object | No | Yes | | Aggregation of `SECURITY_GROUPS` | No | Yes | ### Account Management - Create Workday Accounts. - Aggregation. > **Note** > > The Workday Accounts connector supports filtering of active and future accounts based on the Organization and Organization Reference ID. - Aggregation of future accounts ahead of their hire date. Refer to [Additional Settings]() for more information. - Aggregation of Extended Enterprise Learner Accounts. - Aggregation of Implementer Accounts. > **Note** > > The Workday Accounts SaaS connector does not support creating Implementer user Accounts. - Aggregation of Integration System Accounts. > **Note** > > - The Workday Accounts connector does not support enable/disable operation for Integration System Accounts. To update integration system account, it should be assigned to Integration System. To create integration system account, provisioning policy must have the password and Integration System ID attributes. > - This functionality is applicable only for OAuth 2.0 authentication. - Aggregation of Student Account Types: - Prospects - Applicants - Pre-Matriculant Accounts - Matriculated Accounts ### Group Management - Aggregation of user-based security groups. - Aggregation of Organization roles. - Aggregation of all the types of security groups. - Aggregation of Custom Attributes associated with [Custom Attributes for Organization Role](). #### Provisioning The following table specifies provisioning supported features for supported attributes: | Features | Supported For Employee/Contractors | Service Center Representative Accounts | Supported for Extended Enterprise Learner Accounts | Supported for Implementers Accounts | Supported for Integrations Accounts | Supported for Students Accounts | | --- | --- | --- | --- | --- | --- | --- | | Create Workday Accounts | Yes | Yes | No | No | Yes | Yes | | Add/Remove Organization Role | Yes | No | No | No | No | No | | Add/Remove User-based Security Groups | Yes | Yes | No | Yes | Yes | Yes | | Change Password | Yes | Yes | No | Yes | Yes | Yes | | Update Account | Yes | Yes | No | Yes | Yes | Yes | | Enable/Disable | Yes | Yes | No | Yes | No | Yes | > [!NOTE] > > The Workday Accounts connector supports provisioning of all supported attributes except for `File number` and `Worker type`. ### Learning Management - Aggregation of active and completed courses assigned to the user. Refer to [Learning Management]() for more information. - Aggregation of the "Learning Course Offering Associated with Blended Course", digital course, and learning program as part of group aggregation. - Addition and removal of `ACTIVE_COURSES` to the Workday account. ## Prerequisites A Workday administrator account and password for connecting to the given URL of the Workday tenant. ### Add/Remove User-Based Security Groups To enable the functionality for adding or removing user-based security groups within the Workday Accounts SaaS source, certain prerequisites must be completed. These steps ensure that the appropriate security controls are in place and that the necessary configurations allow this process to work seamlessly. 1. Enable the required domain security policy: 1. Go to **System Functional Area \> Security Administration**. 2. Locate and enable the domain security policy, **"User-Based Security Group Event"**. > **Note** > > Enabling this policy allows the business process to be executed as part of the Workday Accounts SaaS's security configuration. 2. Configure the User-Based Security Group Event: 1. Access the configuration settings for the User-Based Security Group Event for Group. - Specify which security groups can perform workflow-specific actions, such as: - Approve - Ad hoc Approval - Cancel - Deny - Request Reassignment - View all - View Completed Only 2. Define the default settings for the User-Based Security Group Event. > **Important** > > Ensure that the service account is part of the "Initiating Action" for the "User-Based Security Group Event for User (Web Service)." ## Supported Managed Systems The Workday Accounts SaaS connector supports the following versions of the Workday System: - Workday API version 39.1 - Workday API version 38.0 - Workday API version 32.1 - Workday API version 30.1 - Workday API version 24.1 > [!NOTE] > > The Workday Accounts SaaS connector uses Workday's SOAP API, which is independent of the Workday system version and is backward compatible. The Workday Accounts SaaS connector supports the following modules of the Workday system: - Workday HCM - Workday Financial - Workday LMS ## Required Permissions This section describes the permissions required for the Workday Accounts SaaS application on the Workday managed system. ### Basic Authentication Workday Accounts SaaS supports provisioning of Organization Roles. The "Manage: Service Center" permission is required to aggregate service center representative accounts. The following permissions are required for the user in Workday Accounts SaaS: | Operation | Get Permission | Put Permission | | --- | --- | --- | | Aggregate Workday Account | Workday Account; Worker Data: Public Worker Reports; Manage Service Center; Manage: Organization Integrations | | | Update and Enable/Disable Workday Account | | Workday Accounts Domain | | Aggregate Organization Roles | Manage: Organization Roles | | | Add/Remove Organization Roles | | Roles: Manage; Manage: Organization Roles; Assign Role (Web Service) from Business Process Security Policy | | Aggregate user-based Security Groups | User-Based Security Group Administration | | | Provision user-based Security Groups | | Assign Domain Security Policy Permissions to Security Group: User-Based Security Group Administration | > [!NOTE] > > - All the permissions should be assigned under the "Integration Permissions" section. > - Provisioning of Organization Roles is supported for Workday API version 30.1 and onwards. > - On the Workday system, inactive Security Groups are not visible in the UI, however they are aggregated by the connector and can be provisioned. For aggregation of inactive Security Groups, the User-Based-Security-Group must have the ID that is assigned while creating the security group in the Workday system. > - The *Manage: Service Center* permission is required to aggregate service center representative accounts. > - The *Manage: Organization Integrations* permission is required to use the organization type filter. ### OAuth 2.0 Authentication The following permissions are required for the OAuth 2.0 Authentication Type: 1. Create the API Client. Refer to [Create API Client for Integration](<#create-api-client-for-integration>) for more information on API Client creation. 2. Ensure the Workday Account used by the API Client to generate the refresh token is an integration user, and has all the permissions described in [Basic Authentication](<#basic-authentication>). 3. Add all of the following functional areas under the API Client Integration used for OAuth 2.0: - Staffing - System - Organization and Roles - Integration - Extended Enterprise for Learning (if Manage Extended Learner Account is enabled) 4. To fetch the `COMMENT` and `DESCRIPTOR` attributes, the following additional permissions are needed: | Domain | Category | Permission | | --- | --- | --- | | Workday Query Language | Report/Task Permissions | Modify access | | Security Activation | Report/Task Permissions | Modify access | | Security Configuration | Report/Task Permissions | Modify access | 5. To fetch the `OrganizationRole` group object, the following additional permissions are needed for group aggregation: | Domain | Category | Permission | | --- | --- | --- | | Security Administration | Report/Task Permissions | Modify access | Refer to [Group Object: OrganizationRole]() for more information. 6. The following additional permissions are needed to fetch the `SECURITY_GROUPS` group object: | Domain | Category | Permission | | --- | --- | --- | | Workday Query Language | Report/Task Permissions | Modify access | | Security Activation | Report/Task Permissions | Modify access | 7. To aggregate Implementer user accounts, the following additional permissions are needed: | Domain | Category | Permission | | --- | --- | --- | | Workday Query Language | Report/Task Permissions | Modify access | 8. To aggregate Integration accounts, the following additional permissions are needed: | Domain | Category | Permission | | --- | --- | --- | | Workday Query Language | Report/Task Permissions | Modify access | | Security Activation | Report/Task Permissions | Modify access | 9. To aggregate the Integration System ID associated with the integration user, the following permissions are needed: | Domain | Category | Permission | | --- | --- | --- | | Integration Security | Report/Task Permissions | Put access | 10. To manage Student Accounts, the following permissions are needed: | Domain | Category | Permission | | --- | --- | --- | | Workday Query Language | Report/Task Permissions | Get access | | Reports: Student Recruitment | Report/Task Permissions | Get access | | Reports: Students | Report/Task Permissions | Get access | | Integration Build | Integration Permissions | Get access | ### Create API Client for Integration 1. Using the **Register API Client for Integrations** task, register a new API Client for Integrations with the following configurations: 1. Client Name 2. Grant type: Authorization Code Grant 3. Access token: Bearer 4. Select the **Non-Expiring Refresh Tokens** checkbox. 5. Deselect the **Disabled** checkbox. 6. Select the Scope (Functional Areas): Personal Data, Integration. 2. Use the **View API Client for Integrations** task to generate a refresh token. 1. Select the newly created API client, and go to **API Client Actions \> API Client \> Manage Refresh Tokens for Integration**. 2. Select the Workday Account for which the refresh token must be generated, and then select **Next**. 3. Select the **Generate New Refresh Token** checkbox, and then select **OK**.