Skip to content

Provisioning

The Workday Accounts connector supports provisioning, allowing you to create and manage accounts and entitlements in Workday Accounts directly from SailPoint.

Prerequisite: Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

Important

This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

Default Create Account Attributes

The following table shows the attributes in the create account policy:

Account Attribute Description
User Name The Workday Accounts username.
File Number The Workday Accounts file number/service center representative ID.
Worker Type The Workday Accounts worker type. For example, Employee, Contingent_Worker, or Service_Center_Representative.

Note

  • If a business process in Workday requires approval before an account is created, you must approve it manually in the Workday managed system.
  • Workday account creation for terminated and future records is not supported.

Important

  • For the File Number attribute, the worker must already exist in the Workday managed system, and you must provide the file number here.
  • If Username, File Number, or Worker Type is blank, the create operation fails.

Role and Organization Assignment

If a role needs to be configured for an organization that is not present in the aggregated data, add the following attribute to the provisioning policy:

Account Attribute Description
Organization_Reference_ID_Item The reference ID of the organization to assign, other than the default organization that is populated. For example, if the value of ORG_ROLE##ORG_NAME is Admin##Test_Organization and you want to assign the Admin role to a different organization, add this attribute to the provisioning policy with the reference ID of that organization.

Note

The Organization_Reference_ID_Item attribute uses the organization name as the value.

Password Configuration

When creating Workday accounts, you must configure the GENERATE_RANDOM_PASSWORD or PASSWORD attribute in the Create Account policy with an associated value.

  • If the PASSWORD attribute is configured and the required password is provided, the specified password is set for the Workday account.

  • If GENERATE_RANDOM_PASSWORD is set to true, ensure the following:

    • The user has a valid email address on file.
    • The Workday tenant is configured to send security emails.
    • The user cannot use delegated authentication.

Creating Accounts in the Workday System

The Workday Accounts supports creating accounts in the Workday managed system.

The following mandatory fields are required in the provisioning plan to create an account:

Field Description
Username The name of the user.
Filenumber The file number of the worker in the Workday managed system.
Worker type The type of worker, such as Employee or Contingent_Worker.

Notes

For existing Workday Accounts sources, you can create the Create Account policy using the REST API as long as the following schema attributes are mapped to the listed identity attributes:

Schema Attribute Identity Attribute
USERID First Name
FILENUMBER SailPoint User Name
WORKER_TYPE Static (Employee or Contingent_Worker)

Limitations

If a business process set up in the Workday managed system requires approval before an account is created, you must approve it manually in the Workday managed system. The Workday Accounts does not support creating accounts for terminated and future records.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.