Onboard Workday ↗

SaaS Security connects to Workday using OAuth 2.0 authorization via an API Client for Integrations. To enable secure background scanning, you create a non-human integration system user account and associate it with the API client. SaaS Security also pulls data from a custom report that you expose as a web service.

Onboarding consists of four tasks:

  1. Create an Integration System User
  2. Register an API Client for Integrations
  3. Create a Custom Report
  4. Connect SaaS Security to Workday

The onboarding process requires the following credentials:

Item Description
Client ID Generated by Workday to uniquely identify the API Client for Integrations you create.
Client Secret Generated by Workday; used by SaaS Security to authenticate to the API client.
Token Endpoint Used by SaaS Security to generate an authentication token.
Refresh Token A persistent token that maintains a secure connection independently of user sessions.
Custom Audit Log Report Web Service URL The JSON web service URL for the custom report that SaaS Security uses to pull data from your Workday instance.

Task 1 — Create an Integration System User

Create a non-human integration system user account to allow SaaS Security to scan Workday independently of human user sessions.

Step 1 — Identify the administrator account

Required permissions: You must have Security Administrator permissions in Workday to create the integration system user.

Step 2 — Create the integration system user

  1. Log in to the Workday console using the Security Administrator account.
  2. In the search field, search for Create Integration System User and select it from the results.
  3. On the Create Integration System User page, specify a username and password.
  4. Select the Do Not Allow UI Sessions checkbox for enhanced security.
  5. Click OK.

Step 3 — Create a security group for the integration system user

  1. Search for Create Security Group and select it from the results.
  2. On the Create Security Group page:
  3. From the Type of Tenanted Security Group drop-down, select Integration System Security Group (Unconstrained).
  4. Enter a name for the security group and click OK.
  5. On the Integration System Security Group (Unconstrained) page:
  6. In the Integration System Users field, select the integration system user you created.
  7. Click OK.

Step 4 — Assign domain security policy permissions

  1. Search for Maintain Permissions for Security Group and select it from the results.
  2. On the Maintain Permissions for Security Group page:
  3. Set Operation to Maintain.
  4. Set Source Security Group to the security group you created.
  5. Click OK.
  6. On the second Maintain Permissions for Security Group page:
  7. Select the Domain Security Policy Permissions tab.
  8. Add the following domain security policies with View Only access:
Domain Security Policy Access
Workday Accounts View Only
Worker Data: Public Worker Reports View Only
Security Administration View Only
Security Configuration View Only
System Auditing View Only

Step 5 — Activate pending security policy changes

  1. Search for Activate Pending Security Policy Changes and select it from the results.
  2. Enter a comment describing the changes and click OK.
  3. On the confirmation page, select the Confirm checkbox and click OK.

Task 2 — Register an API Client for Integrations

Required permissions: You must have Security Administrator permissions in Workday.

  1. Log in to the Workday console using the Security Administrator account.
  2. Search for Register API Client for Integrations and select it from the results.
  3. On the Register API Client for Integrations page, complete the following fields:
Field Value
Client Name A unique name — for example, SaaS_Security_Integration_Client.
Refresh Token Timeout (in days) The number of days the refresh token is valid — for example, 365. Do not select Non-Expiring Refresh Tokens.
Scope (Functional Areas) Select Tenant Non-Configurable and System. Verify that Workday Query Language appears under the Includes Domains column for the System functional area.
Include Workday Owned Scope Select this checkbox.
  1. Click OK. Workday registers the API client and displays the Client ID and Client Secret.
  2. Copy the Client ID and Client Secret and save them to a text file.

Note: Do not proceed until you have copied both values. You must provide them during onboarding.

  1. Generate a Refresh Token for the integration system user:
    1. On the Edit API Client for Integrations page, click the ellipsis (...) next to the client name.
    2. Select API Client > Manage Refresh Tokens for Integrations.
    3. In the Workday Account field, select the integration system user you created and click OK.
    4. On the Delete or Regenerate Refresh Token page, select Generate New Refresh Token and Confirm Delete.
    5. Click OK.
    6. Copy the Refresh Token and save it to a text file.

Note: Do not proceed until you have copied the Refresh Token.

  1. Get the Token Endpoint:
    1. Search for View API Clients and select it from the results.
    2. On the View API Clients page, copy the Token Endpoint value and save it to a text file.

Note: Do not proceed until you have copied the Token Endpoint.

Task 3 — Create a Custom Report

SaaS Security pulls data from a custom report exposed as a web service. Complete the following steps using the Workday Security Administrator account.

  1. Search for Create Custom Report and select it from the results.
  2. On the Create Custom Report page:
    1. Enter a Report Name.
    2. Select Advanced from the Report Type list.
    3. Select the Enable As Web Service and Optimized for Performance checkboxes.
    4. Set Data Source to Processed Transactions for Range, System Account, Task and Business Object.
    5. Click OK.
  3. On the Edit Custom Report page, select the Columns tab and add the following columns:
Business Object Field Column Heading Override XML Alias
Processed Transaction Classes Updated Classes_Updated
Processed Transaction Instances Updated Instances_Updated
Processed Transaction Secured Task Executed Task_Behavior
Processed Transaction Entry Moment Entry_Moment
Processed Transaction Secured Task Executed Secured_Task_Executed
Processed Transaction Processed Transaction Processed_Transaction
Processed Transaction System Account System_Account
Attributes that Changed Changed Attribute Changed_Attribute
Attributes that Changed Previous Value Previous_Value
Attributes that Changed Value Value
  1. Under Group Column Headings, add the Attributes that Changed business object.
  2. Select the Filters tab and add filters for the Task Behavior field. Add an Or condition for each of the following values (operator: exact match with the selection list, type: Value specified in this filter):
  • Edit Tenant Setup - HCM
  • Edit Tenant Setup - Global
  • Edit Tenant Setup - Security
  • Edit Tenant Setup - System
  • Edit Tenant Setup - Reporting and Analytics
  • Edit Tenant Setup - Recruiting
  • Edit Tenant Setup - Payroll
  • Edit Tenant Setup - Integrations
  1. Select the Prompts tab:
  • Select the Display Prompt Values in Subtitle checkbox.
  • Add the following prompts (mark From Moment and To Moment as Required):
Field Label For Prompt XML Alias Required
From Moment From_Moment Yes
To Moment To_Moment Yes
Business Object Business_Object <p>
</p>
Task Task <p>
</p>
Workday Account Workday_Account <p>
</p>

Note: If the Business Object and Workday Account fields are not available, select Populate Undefined Prompt Defaults to add them.

  1. Select the Share tab and configure the following sharing options:
Field Value
Report Definition Sharing Options Share with specific authorized groups and users
Authorized Groups The security group you created for the integration system user
Authorized Users The integration system user you created
  1. On the Sort tab, do not add or modify any fields. The Sort tab must remain in its default state.
  2. Click OK to save the report.
  3. Get the web service URL:
    1. In the banner of the Create Custom Report page, click the ellipsis (...) next to the report name and select Web Service > View URLs.
    2. On the View URLs Web Service page, locate the JSON section.
    3. Copy the JSON URL and save it to a text file.

Note: Do not proceed until you have copied the JSON web service URL.

Task 4 — Connect SaaS Security to Workday

  1. Log in to Cortex.
  2. Select Settings > Data Sources and Integrations > Add New and click the Workday tile.
  3. On the Capabilities tab, enter a name for this instance.
  4. Under Default Capabilities, confirm Security Posture is selected.
  5. Click Next.
  6. On the Connections tab, select Log in with Credentials.
  7. Enter the following values:
  • Client ID
  • Client Secret
  • Token Endpoint
  • Refresh Token
  • Custom Audit Log Report Web Service URL (JSON format)
  1. Click Next.
  2. On the Configurations tab:
    1. Set the Sync Interval.
    2. (Optional) Add a Tag.
  3. Click Next to complete onboarding.