Workday Integration

To create an Integration System User in Workday:

1. Navigate to Workday.

   NOTE: You must have Admin access to Workday. Workday URLs vary by organization, so use your company’s specific login link. If you do not have access or are unsure how to proceed, contact your Workday Administrator.

2. In the search bar, enter Create Integration System User.

   The Create Integration System User window is displayed.
   
   
   _{The Create Integration System User window.}
    

3. In User Name, enter a unique user name. 
    

4. In Password, enter a password. 

   NOTE:
   Your new password cannot be the same as your current password or your username.
   • It must contain at least 8 characters. 
   • The password must include a mix of the following character types:   
      • Alphabetic characters (letters) 
      • Uppercase letters (A–Z)
      • Lowercase letters (a–z)    
      • Numbers (0–9)
      • Special characters such as: !"#$%&'()*+,-./:;=>?@[\]^_{|}~`

5. Leave all other fields blank. 

   
   _{Example image of the Create Integration System User window. Enter the user name and password. Leave all other fields blank.}
    

6. Select OK. 
    

7. Review the new system user. Select Done. 

   TIP! Record these credentials securely. They will be required for the integration.

   

   _{Example image of the Create Integration System User window. Review the new system user you created, then select Done.} 

Accounts used by system users and integrations are typically configured with non-expiring passwords and should be limited to security administrators.

To prevent the password from expiring:

1. In the search bar, enter Maintain Password Rules.
   
   The Maintain Password Rules window is displayed. 
    

2. In System Users exempt from password expiration, add the Integration System User you created. 

   To add the Integration System User you created earlier:

   1. Select the note menu icon. 
      
      
      _{To add an Integration system user, select the three horizontal lines.}
       

   2. The Search text entry field is displayed. Enter the name of the new system user and press [Enter].
      
      
      _{In the search entry field, enter the name of the new system user.} 
       

      The user added will now appear in the list. 

3. Select OK, then select Done.

To create a new security group:

1. In the search bar, enter Create Security Group.
   
   The Create Security Group window is displayed. 
    
2. From the Type of Tenanted Security Group drop-down, select Integration System Security Group (Unconstrained). 

3. In Name, enter a name for the new security group.
   
   
   _{Example image of the Create Security Group window.} 
    

   TIP! You can use any name, but for consistency, it is recommended to match the Integration System User name.
4. Select OK.
   
   The Edit Integration System Security Group (Unconstrained) window is displayed.
   
   
   _{Example image of the Edit Integration System Security Group (Unconstrained) window.}
    
5. In Integration System Users, add the new Integration System User you created earlier. 
    
6. Select OK, then select Done.

To configure authentication policies:

1. In the search bar, enter Manage Authentication Policies.
   
   The Manage Authentication Policies window is displayed. 
   
   
   _{Example image of the Manage Authentication Policies window.} 
    
2. Select Edit next to the policy you wish to edit.
    
3. Select the + icon to add a new rule.
   
   
   _{Example image showing the + icon to add a new rule.}
   
   A blank ruleset row is inserted in the table.
   
   
   _{Example image showing that a blank new rule row is inserted.}
    
4. In Authentication Rule name, enter Bindbee HRIS.
    
5. From the Security Group drop-down, select the security group you created. 
    

6. In Authentication Condition Name, enter credentials.

   NOTE: You can use any case when you enter 'credentials', there are no restrictions.

   
   
   _{Example image showing policy details added.}  

7. Leave all other fields unchanged.
    
8. Select OK, then select Done.
    
9. Select Activate All Authentication Policies. 
   
   
   _{Example image showing the option to Activate All Authentication Policies.} 
    
10. In Comment, enter a comment describing the change.
    For example: "Exclaimer integration: activated authentication policy for Bindbee HRIS."
     
11. Select OK.
     
12. Select the Confirm checkbox to proceed with the authentication changes.
    
    
    _{Example image showing the Confirm check box option.}
     
13. Select OK, then select Done.

To configure security group permissions:

1. In the search bar, enter Maintain Permissions for Security Group. 
   
   The Maintain Permissions for Security Group window is displayed. 
   
   
   _{Example image showing the Maintain Permissions for Security Group window.}
    
2. In Source Security Group, enter the name of the security group you created.
    
3. Select OK.
    
4. Select the + icon to add a blank row of permissions.
   
   
   _{Example image showing the + icon to add a blank row of permissions.} 
   
    A blank Security policy permission row is inserted in the table.
    

5. Configure the permissions required for Exclaimer to retrieve employee data from your Workday tenant. Exclaimer only retrieves the employee data required to populate and assign email signatures and does not access other sensitive information. 
   
   Add a new row for each permission.
   
   The following table shows the recommended minimum set of Get Only (read-only) permissions:  

   TIP! Copy and paste the permission names directly to search for and add them in Workday. Once you paste the entry, press [Enter]. 

   View/Modify Access	Domain Security Policy	Functional Areas
   Get Only	Worker Data: Public Worker Reports	Staffing
   Get Only	Worker Data: Current Staffing Information	Staffing
   Get Only	Person Data: Contact Information	Contact Information
   Get Only	Worker Data: Organization Information	Staffing
   Get Only	Person Data: Name	Contact Information
   Get Only	Worker Data: Workers	Staffing
   Get Only	Manage: Organization Integration	Organizations and Roles

   NOTE: 
   
   • You only need to fill in the View/Modify Access and Domain Security Policy columns. After you have entered all permissions, select OK, the Functional Areas column will populate automatically.
   
   
   _{Example image showing one row of the View/Modify Access and Domain Security Policy columns. Fill in the remaining permissions and select OK.} 
   
     • If you need custom attributes, you will need additional permissions. Contact the Support team for more information. 

    

6. Select OK, then select Done.

To activate security policy changes:

1. In the search bar, enter Activate Pending Security Policy Changes. 
   
   The Activate Pending Security Policy Changes window is displayed.
   
   
   _{Example image of the Activate Pending Security Policy Changes window.}
    
2. In Comment, enter a comment describing the changes.
   For example: "Exclaimer integration: updated security policy"
    
3. Select OK.
    
4. Select the Confirm checkbox to confirm all security policy changes. 
   
   
   _{Example image showing the Confirm check box option.}
    
5. Select OK.

Follow the steps in the connection window:

1. From the drop-down list, select Workday.
   
   
   _{From the drop-down list, select Workday.}
    

2. Select Connect.
   
   The Workday Permissions window is displayed. Grant read-only access and choose which data models are shared.

   WARNING! If the Workday Permissions window is not displayed, allowlist cdn.bindbee.dev (and preferably .bindbee.dev) to ensure the Bindbee SDK loads correctly in the browser.
   NOTE: If you require additional custom fields, our team can configure them manually. This option is not currently available as a self-service feature. Get in touch with our Support team for help in setting up any required custom fields.

   
   

   _{The Workday Permissions window.} 
    

3. Select Allow and Continue.
    
4. Enter the Integration System User credentials.
   
   
   _{Enter the username and password.}
    
5. Select Next. 
    

6. Enter the Workday Web Services Endpoint URL.

   To obtain the URL:

   1. Within Workday, search for Public Web Services.
      
      The Public Web Services window is displayed.
       
   2. Locate Benefits Administration (Public). Select Web Service, then select View WSDL.
      
      
      _{Example image showing how to access the endpoint URL in Workday. In the Public Web Services window, locate Benefits Administration (Public). Select Web Service, then select View WSDL.}
      
      An XML file is displayed.   

   3. Scroll to the bottom of the page. Copy the URL up to (but not including) /service/. This is the Web Services Endpoint URL.

      WARNING! Do not include the trailing slash after /ccx.

      
      _{Example image of the XML file in Workday.  Copy the URL up to (but not including) /service/.}
       

   4. Paste the URL in the space provided.
      
      
      _{Example image in Exclaimer when trying to connect to the Workday HRIS system.}
       
7. Select Next.
    

8. Enter your Workday tenant name.

   To find your Workday tenant name: 

   1. In the Workday dashboard, check the URL in your browser. Copy the value that appears after workday.com/  
      
      This is the tenant name.
       
   2. Paste this value as the tenant name.
      
      
      _{Enter the Workday tenant name.} 
       

9. Ignore entering the Integration System ID and select Connect to complete the integration between Exclaimer and Workday using Bindbee.
   
   
   _{Example image in Exclaimer. Ignore entering the Integration System ID and select Connect.}
    

   WARNING! Keep the window open until the connection is complete. If you close it too soon, the connection may not finish setting up, and it may not appear as connected in Exclaimer.

   
   
   _{Example screen showing that the connection has been established.}
   
   If you try to connect to Workday again, you may see a message saying that the connector already exists. If this happens, raise a support ticket so the team can assist you. 

   Once a connection is established with the Workday HRIS system, the status displays as Connected in Exclaimer. 
   
   
   _{Once a connection is established with the Workday HRIS system, the Connected text is displayed within Exclaimer.}
    

To re-connect to the Workday HRIS system:

1. Select Re-connect.
   
   A message is displayed that reconnecting will entirely remove your connection to Workday, and any data will no longer be available, and a new connection flow will start automatically.
   
   
   _{Select OK to reconnect to the Workday HRIS system.}  
    
2. Select OK to continue.

To disconnect from the Workday HRIS system:

1. Select Disconnect.
   
   A message is displayed that disconnecting will entirely remove your connection to Workday, and any data from the system will no longer be available.
   
   
   _{Select OK to disconnect from the Workday HRIS system.}  
    
2. Select OK to continue.

Workday connectors automatically synchronize data based on a predefined schedule. You can also initiate a manual sync.

To perform a manual sync: 

1. Select Sync Now.
   
   
   _{Select Sync Now to start a manual sync.} 
    

   NOTE: The Sync Now button is enabled only after 6 hours since the last successful sync. If the button is not enabled, the next sync date and time is displayed. 
   
   
   _{Example image showing that the Sync Now button is not enabled and next sync date and time is displayed.}