Skip to content

Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to Managing Additional Settings.

Account Aggregation Returns Zero Accounts

Issue: Account aggregation completes successfully but returns no accounts from Workday. The integration user may lack the required domain security policy permissions, even if all documented permissions have been assigned.

Resolution: Ask the customer's Workday administrator to verify and configure the following permissions:

  1. In Workday, search for Domain Security Policies for Functional Area.
  2. Select Staffing and go to Worker Data: Workers.

  3. Under the Integration permission section, verify that the SailPoint security group is listed.

    • If the security group is not present, add it to the Integration permission section.

  4. Run the Activate Pending Security Policy Changes task.

  5. Verify that the issue is resolved.

Aggregation Is Passed but the SECURITY_GROUPS Attribute Is Not Fetched

Issue: During entitlement aggregation in the Workday Accounts SaaS, you may encounter one of the following:

  • Aggregation completes successfully, but the SECURITY_GROUPS attribute is not returned.

  • Aggregation fails with the following error:

     invalid request: WQL error.",
 "errors":[{"error":"Enter a valid report field. This field is invalid: cf_SecurityGroupName.",
 "field":"cf_SecurityGroupName",
 "location":"Invalid SELECT clause"

Resolution: Check with your Workday team to verify and correct the configuration by following these steps:

  1. In the search bar, enter Edit Calculated Field.

  2. Search for Security Group Name from the list of Calculated Field.

  3. On the Calculation tab, verify that the Concatenate Text function includes the Security Group field.

    Calculation tab of the Security Group Name calculated field, showing the Concatenate Text function with the Security Group field

  4. On the Additional Info tab, verify that the WQL Alias Name is set exactly as follows: cf_SecurityGroupName.

    Note

    The alias is case-sensitive and must be entered exactly as shown.

    Additional Info tab of the Security Group Name calculated field, showing the WQL Alias set to cf_SecurityGroupName

  5. If the WQL alias is incorrect or missing, update it accordingly.

  6. Save the changes and re-run the entitlement aggregation.

Workday Accounts Connector Does Not Provision Multiple Requests Simultaneously

Resolution: This is a limitation of the Workday API, where multiple provisioning requests containing different entitlements cannot be processed simultaneously. As a workaround, customers should include all required entitlements within a single provisioning request.

Create Account Operation Fails

Issue: The Create Account operation fails with the following error: Please check the logs. Either username, filenumber, or worker-type is empty.

Resolution: The Create Account policy must include values for username, filenumber, and worker-type. If any of these values are missing, the operation will fail with the error mentioned above.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.