# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Account Aggregation Returns Zero Accounts

**Issue**: Account aggregation completes successfully but returns no accounts from Workday. The integration user may lack the required domain security policy permissions, even if all documented permissions have been assigned.

**Resolution**: Ask the customer's Workday administrator to verify and configure the following permissions:

1. In Workday, search for **Domain Security Policies for Functional Area**.
2. Select **Staffing** and go to **Worker Data: Workers**.
3. Under the **Integration permission** section, verify that the SailPoint security group is listed.

   - If the security group is not present, add it to the Integration permission section.
4. Run the **Activate Pending Security Policy Changes** task.
5. Verify that the issue is resolved.

## Aggregation Is Passed but the SECURITY\_GROUPS Attribute Is Not Fetched

**Issue**: During entitlement aggregation in the Workday Accounts SaaS, you may encounter one of the following:

- Aggregation completes successfully, but the `SECURITY_GROUPS` attribute is not returned.
- Aggregation fails with the following error:

  ```text
   invalid request: WQL error.",
   "errors":[{"error":"Enter a valid report field. This field is invalid: cf_SecurityGroupName.",
   "field":"cf_SecurityGroupName",
   "location":"Invalid SELECT clause"
  ```

**Resolution**: Check with your Workday team to verify and correct the configuration by following these steps:

1. In the search bar, enter **Edit Calculated Field**.
2. Search for Security Group Name from the list of **Calculated Field**.
3. On the **Calculation** tab, verify that the **Concatenate Text** function includes the **Security Group** field.

   [![Calculation tab of the Security Group Name calculated field, showing the Concatenate Text function with the Security Group field](<https://documentation.sailpoint.com/connectors/workday_accounts/saas/help/img/security_group_name_calculation.png>)](<https://documentation.sailpoint.com/connectors/workday_accounts/saas/help/img/security_group_name_calculation.png>)
4. On the **Additional Info** tab, verify that the **WQL Alias** Name is set exactly as follows: `cf_SecurityGroupName`.

   > **Note**
   >
   > The alias is case-sensitive and must be entered exactly as shown.

   [![Additional Info tab of the Security Group Name calculated field, showing the WQL Alias set to cf\_SecurityGroupName](<https://documentation.sailpoint.com/connectors/workday_accounts/saas/help/img/security_group_name_additional_info.png>)](<https://documentation.sailpoint.com/connectors/workday_accounts/saas/help/img/security_group_name_additional_info.png>)
5. If the WQL alias is incorrect or missing, update it accordingly.
6. Save the changes and re-run the entitlement aggregation.

## Workday Accounts Connector Does Not Provision Multiple Requests Simultaneously

**Resolution**: This is a limitation of the Workday API, where multiple provisioning requests containing different entitlements cannot be processed simultaneously. As a workaround, customers should include all required entitlements within a single provisioning request.

## Create Account Operation Fails

**Issue**: The Create Account operation fails with the following error: `Please check the logs. Either username, filenumber, or worker-type is empty.`

**Resolution**: The Create Account policy must include values for username, filenumber, and worker-type. If any of these values are missing, the operation will fail with the error mentioned above.