Workday Integration
Workday is a popular cloud-based human capital management system that helps organizations manage their workforce, optimize process , and improve employee experience.
How does this integration help Sprinto
The integration primarily helps Sprinto retrieve staff-related information such as name, email address, job roles, onboarding dates, reporting managers, etc. These details are crucial for managing compliance needs related to people management. Sprinto initiates relevant checks if any of the required information needs to be updated to ensure compliance framework requirements are met.
Sprinto checks for Workday
Here's a list of Sprinto checks available for Workday integration, along with reference procedures on how to fix them:
Staff role should be assigned
All in-scope staff members must have an assigned staff role.
Staff role should be assigned
All in-scope staff members should have an assigned reporting manager.
Note: Top management roles like CEO, CTO, etc. are exceptions.
Staff role should be assigned
Define the joining date for all newly onboarded staff members.
Before you begin
Log in to Sprinto as an administrator.
You must have a paid account on Workday to access API for the integration.
Ensure you have "Admin" access on the Workday account you want to integrate.
You need to create an Integration System User (ISU) on the Workday account to build the integration.
Integrate Sprinto with Workday
Go to System Admin > User, then select the user you want to update.
Click on your desired user and select checkbox for “Is default”.
Create an integration system user on your Workday account.
Log in to the Workday tenant through Workday portal using your credentials.
Take the following steps to create an ISU.
From the Search field, search for Create Integration System User.
Select Create Integration System User from the search result.
On Create Integration System User page, enter the user name. Enter a new password and verify the new password. Note: You cannot use “&”, “<”, and “>” symbols in the password.
Ensure the checkbox is unchecked for the Require New Password at Next Sign In. Note: You must add this user to the System Users list to ensure the password doesn't expire.
Click Ok to create the ISU.
Take the following steps to create a security group.
From Search field, search for Create Security Group and select it from the search result.
Click Ok.
On the Create Security Group page, from the Type of Tenanted Security Group drop-down menu, select Integration System Security Group (Unconstrained).
In the name field, enter a name, then click Ok.
On the Edit Integration System Security Group (Unconstrained) page, in the Name field, enter the same name you entered earlier while creating the ISU.
Click Ok to save changes.
Take the following steps to configure Domain Security Policy Permissions.
From Search field, search for Maintain Permission for Security Group, and select it from the search result.
For Operations, select Maintain.
For Source Security Group, select the security group you have created in the previous step.
Click OK, to save changes.
On Domain Security Policy Permissions, select all policies with Get operations.
Take the following steps to activate the Security Policy Changes.
From Search field, search for Activating Pending Security Policy Change, then select it from the search result.
Add any relevant comments on the pop-up window.
Select the checkbox next to Confirm.
Take the following steps to validate the Authentication Policy.
Check the Manage Authentication Policies section to ensure the created ISU is added to the policy and can access all the necessary domains. The access must not be restricted to only the “SAML” allowed authentication type. If the access is restricted, you can create a new authentication policy with a “User name password” allowed authentication type:
Edit the authentication policies.
Create an Authentication Rule and add the Security Group to the Rule.
Make sure the Allowed Authentication Types is set to a specific User Name Password or set to Any.
Activate all pending authentication policy changes.
From the search bar, search for Activate All Pending Authentication Policy Changes.
This proceeds to the next screen and confirms the changes. This will save the Authentication Policy that was created.
Get the Web Services Endpoint for Workday Tenant
Search for Public Web Services.
Open the Public Web Services Report.
Hover over the human resources and click the three dots to access the menu.
Go to Web Services > View WSDL.
Scroll to the bottom of the opened page and find the host.
Copy everything until you see Services.
Integrate to Workday on Sprinto
Go to Security Hub > Settings > Integrations > Available, then click Connect next to Workday.
On Integration page, select the acknowledgment checkbox and click Connect to Workday. Note: Ensure you have a pop-up window enabled on your browser.
On Workday window, enter your Workday account’s Web Services Endpoint URL, then click Submit.
Enter the ISU credentials you created in Step 1, then click Submit.
Enter the Workday Tenant Name you copied from Step 1, then click Submit.
Configure Workday on Sprinto.
Go to Data Library > People > Configuration, and click Manage.
On Staff information provider page, click Add staff.
On Add staff member page, select Add staff from HRMS, then click the details button next to Workday.
On Add Workday as a provider page, click Add Workday. Note: You should see “Connected” highlighted next to Workday. This means the Workday account is connected and ready for sync information
Final step
Note: After completing Step 3, wait 15 to 20 minutes to let Sprinto finish the data syncing process.
If required, go to Security Hub> People > Configuration, click Manage, and then click Sync next to Workday to refresh the synced information.
Last updated