Skip to main content
All CollectionsIntegrations
Integrating with Workday
Integrating with Workday
Stella Lim avatar
Written by Stella Lim
Updated over 2 months ago

To begin setting up your Workday integration, click on the Settings button and then on Integrations.

Next, click Add to SkyPrep under Workday. If Workday is under the Disabled Integrations list, click Configure.

Next, click Add to SkyPrep under Workday.

Before linking your Workday Account, you will have to ensure your Integration System User has the correct permissions. You will also need your Workday URL.

To enable user permissions, follow the detailed steps for granting permissions below. Steps One through Five are done within your Workday portal, whereas the last step is done on your Merge Link prompt in Skyprep.

Step One: Create an Integration System User (ISU)

  1. In your Workday portal, log into the Workday tenant.

  2. In the Search field, type Create Integration System User.

  3. Select the Create Integration System User task.

  4. On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password.

  5. Click OK.

Note: due to xml encoding, "&", "<", and ">" cannot be included in the password.

Note: Ensure Require New Password at Next Sign In is NOT checked.

Note: You'll want to add this user to the list of System Users to make sure the password doesn't expire.

Step Two: Create a Security Group and Assign an Integration System User

Now, add this Integration System User to a Security Group:

  1. In the Search field, type Create Security Group.

  2. Select the Create Security Group task.

  3. Click OK.

  4. On the Create Security Group page, from the Type of Tenanted Security Group pull-down menu, select Integration System Security Group (Unconstrained).

  5. In the Name field, enter a name.

  6. Click OK.

  7. On the Edit Integration System Security Group (Unconstrained) page, in the Name field, enter the same name you entered when creating the ISU in the first section.

  8. Click OK.

Step Three: Configure Domain Security Policy Permissions

  1. In the Search field, type Maintain Permissions for Security Group

  2. Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2.

  3. Add the corresponding Domain Security Policy with GET operation:

Please note the permissions listed below are the required permissions for the full HRIS API. Permissions can differ from implementation to implementation.

Parent Domains for HRIS:

  • Job Requisition Data

  • Person Data: Name

  • Person Data: Personal Data

  • Person Data: Home Contact Information

  • Person Data: Work Contact Information

  • Worker Data: Compensation

  • Worker Data: Workers

  • Worker Data: All Positions

  • Worker Data: Current Staffing Information

  • Worker Data: Public Worker Reports

  • Worker Data: Employment Data

  • Worker Data: Organization Information

  • Reports: Pay Calcuation Results for Worker (Results)

  • Worker Data: Time Off**

** Specific instructions to allow access to Time Off data can be found here.

Parent Domains for ATS:

  • Candidate Data: Job Application

  • Candidate Data: Personal Information

  • Candidate Data: Other Information

  • Pre-Hire Process Data: Name and Contact Information

  • Job Requisition Data

  • Person Data: Personal Data

  • Person Data: Home Contact Information

  • Person Data: Work Contact Information

  • Manage: Location

  • Worker Data: Public Worker Reports

For a more detailed breakdown of the functional areas that are needed: here

Step Four: Activate Security Policy Changes

  1. In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved.

  2. Add any relevant comments on the window that pops up

  3. Confirm the changes in order to accept the changes that are being made.

Step Five: Validate Authentication Policy is Sufficient

Check the Manage Authentication Policies section to ensure the ISU you created is added to a policy that can access the necessary domains. It should not be restricted to only the "SAML" Allowed Authentication Types – if this is the case, you can create a new Authentication Policy with a "User Name Password" Allowed Authentication Type.

  1. Editing Authentication Policies

  2. Create an Authentication Rule, and add the Security Group to the Rule

  3. Make sure the Allowed Authentication Types is set to specific User Name Password or set to Any

Step Six: Activate All Pending Authentication Policy Changes

  1. In the search bar type, Activate All Pending Authentication Policy Changes

  2. Proceed to the next screen, and confirm the changes. This will save the Authentication Policy that was just created.

Step Seven: Obtain the Web Services Endpoint for Workday Tenant

We'll need access to your specific Workday web services endpoint:

  1. Search in Workday for Public Web Services.

  2. Open Public Web Services Report.

  3. Hover over Human resources and click the three dots to access the menu.

    1. If you are integrating with your Workday ATS, please find Recruiting instead and access that menu.

  4. Click Web Services > View WSDL.

  5. Navigate to the bottom of the page that opens and you'll find the host.

  6. Copy everything until you see /service. This should look something like https://wd5-services1.myworkday.com/ccx.

Enter Credentials into Skyprep.

  1. Workday URL: Enter the Web Services Endpoint you found from Step 5 into Skyprep.

  2. User ID: Enter the Integration System User name for the user created in Step One.

  3. Password: Enter the Integration System User password for the user created in Step One.

  4. Workday Tenant Name: Enter your Workday Tenant name then click Submit.

    Example: If you sign in at "https://wd5-services1.workday.com/acme", enter "acme".

Set the integration to Enabled and fill in Client Namespace, Username, and Password for your Workday account, and designate what user fields you want to use in the Expand Fields area. The expected format for Expand Fields is comma-separated text with no spaces, such as "contacts,employmentstatuses,managername".

Next, set the Time Between API Calls. This sets how quickly the integration can submit API requests which allows you to ensure you stay within your allowed API rate limit.

Termination Date Action lets you decide what happens if a termination date is added to a user's profile in Workday. If Reactivate terminated users in the LMS that are no longer terminated in Workday is turned on, user will be reactivated if the Termination Date was removed.

Enable Email Notifications on New User Creation will send the New User Notification Email to users when new accounts are created via the integration.

Remove users from groups they are no longer a part of in Workday will unenroll users from Groups they are removed from in Workday. This will also unenroll them from any courses and Learning Paths they are enrolled in via that Group.

Deactivate users in the LMS that are no longer in Workday will disable removed users, preventing them from being able to log in while retaining all of their training records.

Next, click on the Data Mapping field.

Here you can choose which SkyPrep Property is linked to your Workday values. The Primary Value is what will be used first, with Secondary Value being used if the Primary value is blank in a user's profile.

You can add additional SkyPrep Properties by adding additional Custom Labels in your Platform Settings area.

Finally, click on Import Rules. This area allows you to set rules to determine which users are added to your platform. To add a rule, click on Add Rule.

You can then set a rule and specify whether the user is added or skipped if they match the conditions.

Did this answer your question?