# Provisioning

The Workday Accounts SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in Workday Accounts directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

The following table shows the attributes in the create account policy:

| Account Attribute | Description |
| --- | --- |
| User Name | The Workday Accounts SaaS username. |
| File Number | The Workday Accounts SaaS file number/service center representative ID. |
| Worker Type | The Workday Accounts SaaS worker type. For example, `Employee`, `Contingent_Worker`, or `Service_Center_Representative`. |

> [!NOTE]
>
> - If a business process in Workday requires approval before an account is created, you must approve it manually in the Workday managed system.
> - Workday account creation for terminated and future records is not supported.

> [!IMPORTANT]
>
> - For the `File Number` attribute, the worker must already exist in the Workday managed system, and you must provide the file number here.
> - If `Username`, `File Number`, or `Worker Type` is blank, the create operation fails.

### Role and Organization Assignment

If a role needs to be configured for an organization that is not present in the aggregated data, add the following attribute to the provisioning policy:

| Account Attribute | Description |
| --- | --- |
| Organization\_Reference\_ID\_Item | The reference ID of the organization to assign, other than the default organization that is populated. For example, if the value of `ORG_ROLE##ORG_NAME` is `Admin##Test_Organization` and you want to assign the `Admin` role to a different organization, add this attribute to the provisioning policy with the reference ID of that organization. |

> [!NOTE]
>
> The `Organization_Reference_ID_Item` attribute uses the organization name as the value.

### Password Configuration

When creating Workday accounts, you must configure the `GENERATE_RANDOM_PASSWORD` or `PASSWORD` attribute in the **Create Account** policy with an associated value.

- If the `PASSWORD` attribute is configured and the required password is provided, the specified password is set for the Workday account.
- If `GENERATE_RANDOM_PASSWORD` is set to `true`, ensure the following:

  - The user has a valid email address on file.
  - The Workday tenant is configured to send security emails.
  - The user cannot use delegated authentication.

## Creating Accounts in the Workday System

The Workday Accounts SaaS supports creating accounts in the Workday managed system.

The following mandatory fields are required in the provisioning plan to create an account:

| Field | Description |
| --- | --- |
| Username | The name of the user. |
| Filenumber | The file number of the worker in the Workday managed system. |
| Worker type | The type of worker, such as `Employee` or `Contingent_Worker`. |

> [!NOTE]
>
> **Notes**
>
> - Use the REST API to add multiple supported attributes to the Create Account policy on the source.
> - Refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community for more information on SailPoint's REST APIs.

For existing Workday Accounts SaaS sources, you can create the Create Account policy using the REST API as long as the following schema attributes are mapped to the listed identity attributes:

| Schema Attribute | Identity Attribute |
| --- | --- |
| USERID | First Name |
| FILENUMBER | SailPoint User Name |
| WORKER\_TYPE | Static (`Employee` or `Contingent_Worker`) |

### Limitations

If a business process set up in the Workday managed system requires approval before an account is created, you must approve it manually in the Workday managed system. The Workday Accounts SaaS does not support creating accounts for terminated and future records.