Before linking your Workday, we'll need to make sure that the correct permissions are enabled. Below are some detailed steps for granting permissions. Steps One through Five are done within your Workday portal, whereas the last step is done on your Merge Link prompt.
Step One: Create an Integration System User (ISU)
In your Workday portal, log into the Workday tenant.
In the Search field, type Create Integration System User.
Select the Create Integration System User task.
On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password.
Note: You'll want to add this user to the list of System Users to make sure the password doesn't expire.
Step Two: Create a Security Group and Assign an Integration System User
Now, add this Integration System User to a Security Group:
In the Search field, type Create Security Group.
Select the Create Security Group task.
On the Create Security Group page, from the Type of Tenanted Security Group pull-down menu, select Integration System Security Group.
In the Name field, enter a name.
On the Edit Integration System Security Group (Unconstrained) page, in the Name field, enter the same name you entered when creating the ISU in the first section.
Step Three: Configure Domain Security Policy Permissions
In the Security Group, you will need to edit the Domain Security Policy Permissions and add the following GET operations. Please note the permissions listed below are the required permissions for the full HRIS API. Permissions can differ from implementation to implementation.
Parent Domains Required for HRIS:
** Specific instructions to allow access to Time Off data can be found here.
Parent Domains Required for ATS:
For a more detailed breakdown of the functional areas that are needed: here
Step Four: Activate Security Policy Changes
In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved. After reviewing policies, approve the pending security policy changes in order to activate them.
Step Five: Validate Authentication Policy is Sufficient
Check the Manage Authentication Policies section to ensure the ISU you created is added to a policy that can access the necessary domains. It should not be restricted to only the "SAML" Allowed Authentication Types – if this is the case, you can create a new Authentication Policy with a "User Name Password" Allowed Authentication Type.
In the search bar, type "Activate All Pending Authentication Policy Changes" to view a summary of the changes in the authentication policy that needs to be approved. After reviewing policies, approve the pending authentication policy changes in order to activate them.
Step Six: Obtain the Web Services Endpoint for Workday Tenant
We'll need access to your specific Workday web services endpoint:
Search in Workday for Public Web Services.
Open Public Web Services Report.
Hover over Human resources and click the three dots to access the menu.
Click Web Services > View WSDL.
Navigate to the bottom of the page that opens and you'll find the host.
Copy everything until you see /service. This should look something like https://wd5-services1.myworkday.com/ccx.
Enter Credentials into Merge Link
Workday URL: Enter the Web Services Endpoint you found from Step 5 into Merge Link.
User ID: Enter the Integration System User name for the user created in Step One.
Password: Enter the Integration System User password for the user created in Step One.
Workday Tenant Name: Enter your Workday Tenant name.
Example: If you sign in at "https://wd5-services1.workday.com/acme", enter "acme".
Linked Implementation Workday accounts will result in slower syncs as there are fewer resources dedicated to the tenant.
The password used cannot contain an "&" or "<", ">" signs.
Please make sure to exempt the ISU Account from MFA and SSO