Skip to main content
Connect Workday to Oleria so it can match every account across your environment to a worker record in your HR system. With Workday connected, Oleria can tie access to each person’s employment status, manager, and organization, and flag access that no longer fits their role or that belongs to someone who has left.

​
What Oleria discovers

  • Workers - active and terminated workers, with employment and staffing details such as job, position, business title, and service dates.
  • Organizations - supervisory organizations, and each worker’s organization and manager.
  • Contact details - worker names and work email addresses, which Oleria uses to match workers to accounts in your other systems.
  • Accounts and security groups - Workday user accounts and their security group membership.

​
Prerequisites

  • Administrator permission on the Oleria workspace
  • Workday admin credentials
Use a service account (and not an employee account) with the suggested privileges for the integration to ensure continuity.

​
Create an Integration System User in Workday

Create an Integration System User and grant View Only permissions.
1

Create the Integration System User

Sign in to Workday. Type Create integration system user in the search window and select the task.The Create Integration System User window opens. Provide the following:
  • User Name - a name you’ll recognize later, for example Oleria Integration System User. The steps below refer to this user by that name.
  • Password
  • Set Session timeout minutes to 0
  • Select the Do Not Allow UI Sessions checkbox Create Integration System User form with Do Not Allow UI Sessions selected
2

Exempt the user from password expiration

In the search window, type Maintain Password Rules and select the task.Under System Users exempt from password expiration, search and add the Oleria Integration System User.Workday System Users exempt from password expiration with Oleria user added
3

Create an integration security group

In the search window, type Create security group and select the task.From the Type of Tenanted Security Group dropdown, select Integration System Security Group (Unconstrained) and give it a name, for example, Oleria Integration Security Group.Workday security group type dropdown with Integration System Security Group selected
4

Add the user to the security group

From the Integration System User field, search and select the Oleria Integration System User created in the previous step.Workday Integration System User field with Oleria user selected
5

Add permissions to the security group

In the search window, type Maintain permissions for Security Group and select the task.Search and add the Oleria Integration Security Group in the Source Security Group field. Select Ok.Maintain Permissions for Security Group task with the Oleria Integration Security Group in the Source Security Group fieldIn Maintain Permissions for Security Group -> Domain Security Policy Permissions, add the following domain permissions. Grant View Only, Get Only, or both, as listed for each domain.Workday Domain Security Policy Permissions table with Oleria required permissions
6

Activate pending security policy changes

Type Activate Pending Security Policy Changes in the search window and select the task.Provide a comment and select OK.Activate Pending Security Policy Changes with a comment enteredOn the next screen, select the Confirm checkbox and select OK.Activate Pending Security Policy Changes confirmation with the Confirm checkbox selected
7

Register a new API client

Type Register API Client for integrations in the search window and select the task.
  • Enter a name for your API client in the Client Name field.
  • Clear the Non-Expiring Refresh tokens checkbox.
  • Add 180 in the Refresh Token Timeout (in days) field.
  • Search and add the following scopes in the Scope (Functional Areas) field:
    • Integration
    • Jobs & Positions
    • Organizations and Roles
    • Personal Data
    • Public Data
    • Staffing
    • System
    • Tenant Non-Configurable
    • Worker Profile and Skills
    • Contact Information
  • Select the Include Workday Owned Scope checkbox. Select the Include Workday Owned Scope checkbox
Copy the Client ID and Client Secret shown on the next page.Registered API client details showing the Client ID and Client Secret
8

Generate a refresh token

Type View API Clients in the search window and select the task.Select API Client for Integrations.Select API Client for IntegrationsSelect the API client registered in the previous step.Select the ellipsis -> API client -> Manage Refresh Tokens for Integrations.Ellipsis menu open on the API client, with API client -> Manage Refresh Tokens for Integrations highlightedSearch and select the Oleria Integration System User created above. Select Ok.Manage Refresh Tokens for Integrations with the Oleria Integration System User selectedThe Delete or Regenerate Refresh Token dialog opens. Select the Generate New Refresh Token checkbox, then copy the refresh token Workday generates. You’ll paste it into Oleria in the next section.Delete or Regenerate Refresh Token dialog with Generate New Refresh Token selected

​
Connect Workday to Oleria

1

Open the integration and provide credentials

Go to your Oleria workspace, select Integrations -> select Workday, and provide the following:
  • Hostname - the host part of your Workday REST API endpoint, without https:// or any path (for example, wd2-impl-services1.workday.com). To find the endpoint, sign in to Workday and search for View API Clients. The endpoint appears at the top of the page.
  • Tenant Id - your Workday tenant name: the path segment after /ccx/api/v1/ in the same REST API endpoint. It also appears as the organization ID in your Workday account menu.
  • Client ID - from the Register a new API client step
  • Client Secret - from the Register a new API client step
  • Refresh Token - from the Generate a refresh token step
  • Refresh Token Expiry (optional) - enter 180, the Refresh Token Timeout (in days) you set when you registered the API client. Workday account menu showing the organization ID used as the Tenant ID Oleria workspace Workday integration form showing optional Refresh Token Expiry field
The refresh token expires 180 days after you generate it, even if Oleria uses it every day, and the integration stops syncing when it does. Before it expires, generate a new refresh token in Workday with Manage Refresh Tokens for Integrations, then edit the Workday integration in Oleria and paste in the new Refresh Token. Oleria doesn’t renew the refresh token or warn you before it expires, so set a reminder to regenerate it.

​
Verify the integration

Confirm the Workday instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. To see more detail about its health, select View Details on the Workday instance to open the side pane. After the first sync completes, you can review the discovered workers and organizations in your Oleria workspace.

​
Contact us

For questions about this integration, contact us at support@oleria.com.