Workday
  • 10 Oct 2024
  • 6 Minutes to read
  • Dark
    Light
  • PDF

Workday

  • Dark
    Light
  • PDF

Article summary

Workday offers software solutions for financial management, human resources, and planning.

Related Enforcement Actions:

Types of Assets Fetched

This adapter fetches the following types of assets:

  • Users
  • Application Settings

Parameters

  1. Workday Domain (required) - The hostname of the Workday server. For more information, see Find the Workday Domain.

  2. Workday Tenant Name (required) - Tenant name as supplied by Workday.

  3. User Name and Password (optional) - The credentials for a user account that has the Required Permissions to fetch assets. You can either authenticate with user name and password, or with X.509 authentication.

  4. Fetch Events Effective X Days Forward (optional, default: 30) - Specify a numerical value to set an effective future date to ensure that information about future hires is accurate. The value can be any integer.

    • If a value is specified, this adapter will fetch information relating to future events up to the number of days set in the future.
    • If this field is left empty, this adapter will fetch information relating to events up to 30 days in the future.
  5. Custom Report URL (optional) - Enter a SOAP URL for a Workday Custom Report endpoint.

    • Do not include the main Workday domain base or the "?wsdl" portion of the URL. For example, if the custom report URL is https://wd5-services1.myworkday.com/ccx/service/customreport1/example/custom_report?wdsl, the value you should enter here should just be ccx/service/customreport1/example/custom_report.
    • The Custom Report must also contain the ‘Employee_ID’ field to match the corresponding worker.
  6. Fetch Only from the Custom Report - Select this option to create users only from the custom report data.

    Note:
    • Each entry should have the following field for uniqueness: Employee_ID
    • Each entry should include the following fields for correlation: mail; username, first_name, last_name
    • The following fields will be parsed as mail: Work_Email, Email, and email
  7. X.509 Private Key (optional) - Upload the private key file created.

  8. X.509 Public Key (optional) - Upload the X.509 certificate file issued by Workday.

  9. X.509 Passphrase (optional) - Enter your passphrase.

  10. Tenant Login URL (Only for accounts with SaaS Management capability) (optional) - Enter the login URL where admins sign in to their working environment.

  11. Read Only Admin Username and Read Only Admin Password (Only for accounts with SaaS Management capability) (optional) - The credentials that are separate from the already existing username and password fields. This is needed in order to fetch application settings.

  12. 2FA Secret Key (Only for accounts with SaaS Management capability) (optional) - The secret generated in the adapter for setting up 2-factor authentication for the adapter user created to fetch SaaS Management data.

  13. Verify SSL - Select to verify the SSL certificate offered by the value supplied in Workday Domain. For more details, see SSL Trust & CA Settings.

  14. HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

  15. HTTPS Proxy User Name (optional) - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

  16. HTTPS Proxy Password (optional) - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection

Workday_Adapter

Advanced Settings

Note:

Advanced settings can either apply for all connections for this adapter, or you can set different advanced settings and/or different scheduling for a specific connection, refer to ​Advanced Configuration for Adapters

  1. Users Chunk Per Page (optional, default: 200) - Enter the number of users per a single request.
  2. Preferred Email Domain (optional) - Enter the preferred domain for work email addresses (such as ThisEmailDomain.com) for each user. When the field is empty, Axonius uses the last email address within the list of addresses in the Mail field.
  3. Exclude Specified User Email (optional) - Enter an email address that you want to exclude from the fetch.
  4. Include Contingent Workers in Fetch - Select to include contingent workers in the fetch.
  5. Disable Management Chain Enrichment - Select this option to disable the Management Chain Enrichment process and thus not enrich the management workers list with additional information about each manager.
  6. Fetch only the most recent records for each worker - Select this option to fetch only the most recent records for each worker.
  7. Fetch user assets - Select this option to fetch user assets.
  8. Include Custom Organization Data - Select this option to include custom organization data.
  9. Include Cost Center Organization Data - Select this option to include cost center data under organization data.
  10. Enable real-time asset updates (Supported events: New hires, New terminations) - Select this option to trigger an event in a workflow. Enabling the option will both fetch users that have been hired or terminated in the last time interval and will trigger the respective event. All workflows configured with this event are then triggered.
  11. Run Differential Fetch - Reserved for later use.
  12. Fetch Application Settings (Only for accounts with SaaS Management capability) - Select this option to fetch application settings.
  13. Fetch Only Application Settings (Only for accounts with SaaS Management capability) - Select this option to fetch only application settings. No other assets will be fetched.
Note:

To learn more about Adapter Configuration tab advanced settings, see Adapter Advanced Settings.

APIs

Axonius uses the Workday Human Resources SOAP API.

Required Permissions

The value supplied in User Name must have access to the following domains:

  • Self-Service: Current Staffing Information
  • Worker Data: Current Staffing Information
  • Worker Data: Workers
  • Worker Data: Public Worker Reports

In addition, to fetch SaaS data (for accounts with SaaS Management) the user must belong to security domains that allow access to the Workday UI through their user credentials, and (View Only) access to the following Workday tasks:

  • Password Rules
  • Tenant Setup Security

Find the Workday Domain

To Locate the Workday Domain

  1. Log into the Workday console.

  2. Search for the “Public Web Services” report.

  3. Open the “Public Web Services Report”.
    Workday_PWS

  4. Hover over “Human Resources” and click the three dots to access the menu.

  5. Navigate to Web Services > View WSDL.

  6. On the bottom of the page, find the location parameter in the soapbind:address tag (see screenshot below).

  7. Copy the parameter until /service.
    Workday_Domain

  8. Back in Axonius, paste the copied value in the Workday Domain field.

Create an Integration System User

In order to fetch User data, you need to create an Integration System User (ISU) with the required permissions. To create an ISU, follow the instructions detailed in How to create an ISU user in Workday.

  1. In order to fetch SaaS/SSPM data from Workday do the following:
    1. Create a dedicated workday user account ( auditor group read-only )
  2. In the Connection configuration make sure you fill in the following:
    1. Tenant Login URL ( the URL this user would use to log into the workday dashboard )
    2. Read Only Admin Username ( of the user account)
    3. Read Only Admin Password ( of the user account)
    4. 2FA Secret Key ( Optional - if the user account has the 2nd factor auth protection )
  3. In Advanced configurations select:
    1. Fetch Application Settings ( enabled )

Version Matrix

This adapter has only been tested with the versions marked as supported, but may work with other versions. Please contact Axonius Support if you have a version that is not listed, and it is not functioning as expected.

VersionSupportedNotes
34.0 and upYes



Was this article helpful?