Skip to content

Integrating SailPoint with Workday Accounts

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a Workday Accounts connector in SailPoint.

Connecting SailPoint to your Workday Accounts connector allows you to aggregate Workday Account records from Workday and enable/disable the Workday Accounts.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SailPoint Workday Accounts connector supports the following features.

The following table specifies which kind of authentication is required for each supported feature:

Supported Features Basic Authentication OAuth 2 Authentication
Manage Active, Terminated, Future Accounts Yes Yes
Filter Accounts by Organization Yes Yes
Manage Service Center Representative Accounts Yes Yes
Manage Extended Enterprise Learner Accounts Yes Yes
Manage Implementers Accounts No Yes
Manage Integration System Accounts No Yes
Manage Workday Accounts for Students No Yes
Manage Additional Group Schema Attributes No Yes
Aggregation of User-based security groups Yes (Partial) - the COMMENT and DESCRIPTOR attributes are only supported for the OAuth 2.0 Authentication Type Yes
Aggregation of Organization roles as Group Object No Yes
Aggregation of SECURITY_GROUPS No Yes

Account Management

  • Create Workday Accounts.

  • Aggregation.

    Note

    The Workday Accounts connector supports filtering of active and future accounts based on the Organization and Organization Reference ID.

  • Aggregation of future accounts ahead of their hire date. Refer to Additional Settings for more information.

  • Aggregation of Extended Enterprise Learner Accounts.

  • Aggregation of Implementer Accounts.

    Note

    The Workday Accounts connector does not support creating Implementer user Accounts.

  • Aggregation of Integration System Accounts.

    Note

    • The Workday Accounts connector does not support enable/disable operation for Integration System Accounts. To update integration system account, it should be assigned to Integration System. To create integration system account, provisioning policy must have the password and Integration System ID attributes.
    • This functionality is applicable only for OAuth 2.0 authentication.

  • Aggregation of Student Account Types:

    • Prospects
    • Applicants
    • Pre-Matriculant Accounts
    • Matriculated Accounts

Group Management

  • Aggregation of user-based security groups.
  • Aggregation of Organization roles.
  • Aggregation of all the types of security groups.
  • Aggregation of Custom Attributes associated with Custom Attributes for Organization Role.

Provisioning

The following table specifies provisioning supported features for supported attributes:

Features Supported For Employee/Contractors Service Center Representative Accounts Supported for Extended Enterprise Learner Accounts Supported for Implementers Accounts Supported for Integrations Accounts Supported for Students Accounts
Create Workday Accounts Yes Yes No No Yes Yes
Add/Remove Organization Role Yes No No No No No
Add/Remove User-based Security Groups Yes Yes No Yes Yes Yes
Change Password Yes Yes No Yes Yes Yes
Update Account Yes Yes No Yes Yes Yes
Enable/Disable Yes Yes No Yes No Yes

Note

The Workday Accounts connector supports provisioning of all supported attributes except for File number and Worker type.

Learning Management

  • Aggregation of active and completed courses assigned to the user. Refer to Learning Management for more information.
  • Aggregation of the "Learning Course Offering Associated with Blended Course", digital course, and learning program as part of group aggregation.
  • Addition and removal of ACTIVE_COURSES to the Workday account.

Prerequisites

A Workday administrator account and password for connecting to the given URL of the Workday tenant. To manage user groups within the Workday Accounts Source, follow the provided set of instructions for adding or removing groups.

To aggregate and provision organization roles, you must add the ORG_ROLE##ORG_NAME schema attribute in the account schema as a multi-valued entitlement of type OrganizationRole. Refer to Aggregation of Organization Role with Organization Name for more information.

Add/Remove User-Based Security Groups

To enable the functionality for adding or removing user-based security groups within the Workday Accounts source, certain prerequisites must be completed. These steps ensure that the appropriate security controls are in place and that the necessary configurations allow this process to work seamlessly.

  1. Enable the required domain security policy:

    1. Go to System Functional Area > Security Administration.

    2. Locate and enable the domain security policy, "User-Based Security Group Event".

      Note

      Enabling this policy allows the business process to be executed as part of the Workday Accounts's security configuration.

  2. Configure the User-Based Security Group Event:

    1. Access the configuration settings for the User-Based Security Group Event for Group.

      • Specify which security groups can perform workflow-specific actions, such as:

        • Approve
        • Ad hoc Approval
        • Cancel
        • Deny
        • Request Reassignment
        • View all
        • View Completed Only

    2. Define the default settings for the User-Based Security Group Event.

    Important

    Ensure that the service account is part of the "Initiating Action" for the "User-Based Security Group Event for User (Web Service)."

Supported Managed Systems

The Workday Accounts connector supports the following versions of the Workday System:

  • Workday API version 39.1
  • Workday API version 38.0
  • Workday API version 32.1
  • Workday API version 30.1
  • Workday API version 24.1

Note

The Workday Accounts connector uses Workday's SOAP API, which is independent of the Workday system version and is backward compatible.

The Workday Accounts connector supports the following modules of the Workday system:

  • Workday HCM
  • Workday Financial
  • Workday LMS

Required Permissions

This section describes the permissions required for the Workday Accounts application on the Workday managed system.

Basic Authentication

Workday Accounts supports provisioning of Organization Roles.

The "Manage: Service Center" permission is required to aggregate service center representative accounts.

The following permissions are required for the user in Workday Accounts:

Operation Get Permission Put Permission
Aggregate Workday Account Workday Account; Worker Data: Public Worker Reports; Manage Service Center; Manage: Organization Integrations
Update and Enable/Disable Workday Account Workday Accounts Domain
Aggregate Organization Roles Manage: Organization Roles
Add/Remove Organization Roles Roles: Manage; Manage: Organization Roles; Assign Role (Web Service) from Business Process Security Policy
Aggregate user-based Security Groups User-Based Security Group Administration
Provision user-based Security Groups Assign Domain Security Policy Permissions to Security Group: User-Based Security Group Administration

Note

  • All the permissions should be assigned under the "Integration Permissions" section.
  • Provisioning of Organization Roles is supported for Workday API version 30.1 and onwards.
  • On the Workday system, inactive Security Groups are not visible in the UI, however they are aggregated by the connector and can be provisioned. For aggregation of inactive Security Groups, the User-Based-Security-Group must have the ID that is assigned while creating the security group in the Workday system.
  • The Manage: Service Center permission is required to aggregate service center representative accounts.
  • The Manage: Organization Integrations permission is required to use the organization type filter.

OAuth 2.0 Authentication

The following permissions are required for the OAuth 2.0 Authentication Type:

  1. Create the API Client. Refer to Create API Client for Integration for more information on API Client creation.
  2. Ensure the Workday Account used by the API Client to generate the refresh token is an integration user, and has all the permissions described in Basic Authentication.

  3. Add all of the following functional areas under the API Client Integration used for OAuth 2.0:

    • Staffing
    • System
    • Organization and Roles
    • Integration
    • Extended Enterprise for Learning (if Manage Extended Learner Account is enabled)

  4. To fetch the COMMENT and DESCRIPTOR attributes, the following additional permissions are needed:

    Domain Category Permission
    Workday Query Language Report/Task Permissions Modify access
    Security Activation Report/Task Permissions Modify access
    Security Configuration Report/Task Permissions Modify access

  5. To fetch the OrganizationRole group object, the following additional permissions are needed for group aggregation:

    Domain Category Permission
    Security Administration Report/Task Permissions Modify access

    Refer to Group Object: OrganizationRole for more information.

  6. The following additional permissions are needed to fetch the SECURITY_GROUPS group object:

    Domain Category Permission
    Workday Query Language Report/Task Permissions Modify access
    Security Activation Report/Task Permissions Modify access
    Worker Data: Active and Terminated Workers Integration Permissions Get access
    Worker Data: Current Staffing Information Integration Permissions Get access

  7. To aggregate Implementer user accounts, the following additional permissions are needed:

    Domain Category Permission
    Workday Query Language Report/Task Permissions Modify access

  8. To aggregate Integration accounts, the following additional permissions are needed:

    Domain Category Permission
    Workday Query Language Report/Task Permissions Modify access
    Security Activation Report/Task Permissions Modify access

  9. To aggregate the Integration System ID associated with the integration user, the following permissions are needed:

    Domain Category Permission
    Integration Security Report/Task Permissions Put access

  10. To manage Student Accounts, the following permissions are needed:

    Domain Category Permission
    Workday Query Language Report/Task Permissions Get access
    Reports: Student Recruitment Report/Task Permissions Get access
    Reports: Students Report/Task Permissions Get access
    Integration Build Integration Permissions Get access

Create API Client for Integration

  1. Using the Register API Client for Integrations task, register a new API Client for Integrations with the following configurations:

    1. Client Name
    2. Grant type: Authorization Code Grant
    3. Access token: Bearer
    4. Select the Non-Expiring Refresh Tokens checkbox.
    5. Deselect the Disabled checkbox.
    6. Select the Scope (Functional Areas): Personal Data, Integration.

  2. Use the View API Client for Integrations task to generate a refresh token.

    1. Select the newly created API client, and go to API Client Actions > API Client > Manage Refresh Tokens for Integration.
    2. Select the Workday Account for which the refresh token must be generated, and then select Next.
    3. Select the Generate New Refresh Token checkbox, and then select OK.

Creation of the Integration Security Group

This section describes creation of the integration security group for constrained and unconstrained security groups.

Constrained

  1. On the Workday Accounts system, search for the Create Security Group task.
  2. Select Integration System Security Group (Constrained).

  3. Provide a name for the integration group. Create two groups as follows:

    • For the Read group (SailPoint_Read_Group)
    • For the Write (provisioning) group (SailPoint_Write_Group)

  4. Add the Integration System Users created for the integration to the respective groups.

  5. Select single or multiple organizations for which the integration group would have access.

    Note

    The organizations selected have to be of the same type (such as SUPERVISORY, COST_CENTER).

  6. For access rights to organizations, select the option for Applies to Current Organization Only.

Unconstrained

  1. Create the Integration System Security Group (Unconstrained).

  2. Perform the following for the Integration System Security Group:

    • Add the user in the Integration System Security Group (Unconstrained). The permissions are given to integration system groups that are attached to the integration system.
    • Modify the Integration System Security Group to associate the Maintain Contact Information domain.
    • Modify the Integration System Security Group to associate the domains required by the Workday Integration System.

Note

The Workday fields in the Workday Managed System that are marked as private are not accessible through the Workday API. The fields marked as public are accessible. To ensure that the Workday source aggregates all applicable attributes, you must mark them as public.

Virtual Appliance Cluster

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.