Setup Guide: Linking Workday with an Integration System User

Contents

• Requirements
• Create an Integration System User (ISU)
• Create a Security Group and assign an Integration System User
• Configure domain security policy permissions
• Permissions for HRIS data
• Activate security policy changes
• Validate the authentication policy is sufficient
• Activate all pending authentication policy changes
• Obtain the web services endpoint URL
• Learn more

Note: The written instructions below are updated more frequently than our video guide, which may not always reflect the latest changes to Workday's interface.

Requirements

• To authenticate your Workday account, you will need to provide the following information:
  • WSDL
  • ISU Username
  • ISU Password
  • Workday Tenant Name
• You have Administrator permissions in your company's Workday instance

Important:

• Implementation/sandbox tenant Workday accounts will result in slower syncs, as fewer resources are dedicated to the tenant
• In order to increase resourcing for API limits for your Workday tenant, please reach out to Workday Support or your Workday Customer Account Manager.
• You can submit a request to Workday Support through the Workday Community support portal

Create an Integration System User (ISU)

1. In your Workday portal, log into the Workday tenant
2. In the Search field, type Create Integration System User
3. Select the Create Integration System User task

4. On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password. Important: "&", "", or ">" characters cannot be included in the password
5. Click OK

6. To ensure the password doesn't expire, you'll want to add this new user to the list of System Users. To do this, search for the Maintain Password Rules task.

7. Add the ISU to the System Users exempt from password expiration field

8. Enter the Integration System Username and Password in the linking flow

Create a Security Group and assign an Integration System User

1. In the Search field, type Create Security Group. Select the Create Security Group task.

   

    

2. On the Create Security Group page, select Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group pull-down menu.

3. In the Name field, enter a name
4. Click OK

5. On the Edit Integration System Security Group (Unconstrained) page, in the Integration System Users field, enter the same name you entered when creating the ISU in the first section

   

    

6. Click OK

Configure domain security policy permissions

1. In the Search field, type Maintain Permissions for Security Group

   

    

2. Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2

   

    

3. On the next screen, add the corresponding Domain Security Policies depending on your use case:

Permissions for HRIS data

You will need to configure different permission domains in your Workday ISU for HRIS. This guide will walk you through the permissions you need for HRIS data.

Please note that the permissions listed below are the required permissions for the full standard HRIS integration. Required permissions can differ based on the use case. If your use case does not require certain data (e.g., Employee's Dependent data or Timesheet Entries), you can exclude the permissions.

For a more detailed breakdown, see the Breakdown of domains section below.

Breakdown of domains

Activate security policy changes

1. In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved

   

    

2. Add any relevant comments on the window that pops up

3. Confirm the changes in order to accept the changes that are being made and hit OK

   

Validate the authentication policy is sufficient

1. Search for Manage Authentication Policies

   

    

2. Click Edit on the authentication policy row

   

    

3. Create an Authentication Rule

   

    

4. Enter a name, add the Security Group, and ensure Allowed Authentication Types is set to Specific User Name Password or Any

   

    

Activate all pending authentication policy changes

1. In the search bar type, activate all pending authentication policy changes

   

    

2. Proceed to the next screen and confirm the changes. This will save the Authentication Policy that was just created or edited

Obtain the web services endpoint URL

1. Search in Workday for Public Web Services

   

    

2. Find Human Resources (Public) to connect Workday HRIS. Click the three dots to access the menu. Click Web Services > View WSDL

   

    

3. Navigate to the bottom of the page that opens (it may take a few seconds to load)

4. Copy the full URL provided under Human_ResourcesService (Workday HRIS). The URL will have a format similar to https://wd2-impl-services1.workday.com/ccx/service/acme/Human_Resources/v43.0

   

    

5. Enter the Web Services Endpoint URL into the linking flow

   

6. Click Submit

Learn more

• HRIS Integration (Add-on)
• Contact ActivTrak Support