# Integration with Workday

### Overview

Integrating Workday with MangoApps enables synchronization of user data from Workday's HRIS system into MangoApps. This integration helps with user management, ensures data consistency, and improves user experience by automatically syncing employee information like name, contact details, employment status, and more. 

<figure><img src="/files/XcNOyRvmsHuqVL6ZToiY" alt="" width="375"><figcaption></figcaption></figure>

This guide outlines the steps required to successfully set up and manage the integration between Workday and MangoApps.

***

### Required Roles

To complete this integration, specific administrative roles and permissions are required on both platforms:

#### In Workday

* You must have **Administrator permissions** in your company’s Workday tenant.
* You must be able to create and manage Integration System Users, Security Groups, and Domain Security Policies.

#### In MangoApps

* You must be a **Domain Admin** with access to the Admin Portal and Integration settings.

***

### Workday Side Setup

#### Step 1: Create an Integration System User (ISU)

In Workday, search for **Create Integration System User**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcyBqUo8v-N6bIhA4z_ZkYQ8bBEmF1A8knZv4u1PvbrSs5WpmMjdNBNMXWThsYX1KEI6Bbf99tAfPK0rN-zDHh153jZaETX1fQrSqCWRguQNub-YZ1lESqeQ6OQL4-Kq9rZziks?key=SPxmwHQgNcbr6Jm8Fr50iA" alt="" width="563"><figcaption></figcaption></figure>

Fill in the user name and password fields (avoid using &, <, > as these **cannot** be included in the password).

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcEZJo0W-VtyGgro2QT0gGvUIpv2Gc7eiRZpcQapNnhCZW4bEALRY6xpgQCaNSoCy1vzJkELpnmV8sA9V6xK835f1zZ_dZCR4e03Ko7MByzI2pKu6LFpRJ09VJOVF3mr2NXuPm9?key=SPxmwHQgNcbr6Jm8Fr50iA" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="danger" %}
Do **NOT** check the box next to **Require New Password at Next Sign In**.
{% endhint %}

To ensure the password does not expire, we will want to add this new user to the list of System Users.

To do this, save and then search for **Maintain Password Rules**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfAzr9suVrLbm1n3KdxhuE1LZQ8HacB4d6a9ons7GxSTzPEZ4YZ3CDyr3791VQGwzZnmlobz1Rc5GRPWLInhRGDgKxVd-9RUFN7YknSX75MJNr6OdpKKGVzgftm-jQmpZIsWTt8lA?key=SPxmwHQgNcbr6Jm8Fr50iA" alt="" width="563"><figcaption></figcaption></figure>

Add the ISU to the list of **System Users exempt from password expiration**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdKgELCxetPvjUpJyuvMgDvGN0vc1xLnEgfiKLKi-WIypgDOL-lcEJ4usMo1tigdwJZ4VvssztpMj6EolXQPvaoNL8jdMMY1rxqwIydr5ubEKR0yljYl02J54_NwpJ7c6S6C0pV?key=SPxmwHQgNcbr6Jm8Fr50iA" alt="" width="563"><figcaption></figcaption></figure>

***

#### Step 2: Create a Security Group

Search for **Create Security Group**.

<figure><img src="/files/BsMGmVdNCjsWwsOrLfz7" alt="" width="563"><figcaption></figcaption></figure>

Choose **Integration System Security Group (Unconstrained)**.

<figure><img src="/files/KFBokNdK7AowrwvfGDvl" alt="" width="563"><figcaption></figcaption></figure>

Name the group and assign the ISU created earlier in Step 1.

<figure><img src="/files/0y52QCDNlN0JIlgV29ja" alt="" width="563"><figcaption></figcaption></figure>

***

#### Step 3: Configure Domain Security Policy Permissions

Search for **Maintain Permissions for Security Group**.

<figure><img src="/files/F7aoj1fPzHb02W4x9sCf" alt="" width="563"><figcaption></figcaption></figure>

For the Operation, select **Maintain**. Then, in the **Source Security Group**, choose the above configured security group.

<figure><img src="/files/Bw399QhFA77QdHFvqxk5" alt="" width="563"><figcaption></figcaption></figure>

On the next screen, add the corresponding **Domain Security Policies** depending on your use case.

<figure><img src="/files/uDHeGCVRaZavZGzj6LKw" alt=""><figcaption></figcaption></figure>

If you are connecting Workday HRIS, the following permissions need to be allowed:

<table><thead><tr><th width="198">Operation</th><th>Domain Security Policy</th></tr></thead><tbody><tr><td>Get Only</td><td><p><strong>Worker Data: Public Worker Reports</strong></p><p>This is the minimum required permission</p></td></tr><tr><td>Get Only</td><td>Person Data: Name</td></tr><tr><td>Get Only</td><td>Person Data: Personal Data</td></tr><tr><td>Get Only</td><td>Person Data: Home Contact Information</td></tr><tr><td>Get Only</td><td>Person Data: Work Contact Information</td></tr><tr><td>Get Only</td><td><p><strong>Person Data: Private Work Email Integration</strong></p><p>This is required to surface work email of Employees</p><p><br></p></td></tr><tr><td>Get Only</td><td><p><strong>Person Data: Public Work Email Address Integration</strong></p><p>This is required to surface work email of Employees</p><p><br></p></td></tr><tr><td>Get Only</td><td>Worker Data: Compensation</td></tr><tr><td>Get Only</td><td>Worker Data: Compensation by Organization</td></tr><tr><td>Get Only</td><td>Worker Data: Workers</td></tr><tr><td>Get Only</td><td>Worker Data: All Positions</td></tr><tr><td>Get Only</td><td><p><strong>Worker Data: Current Staffing Information</strong></p><p>This is required to surface the Employment Status of Employees</p><p><br></p></td></tr><tr><td>Get Only</td><td>Worker Data: Employment Data</td></tr><tr><td>Get Only</td><td><p><strong>Worker Data: Compensation - All Workers’ Positions Past and Present</strong></p><p>This is required to pull Historical Employment</p><p><br></p></td></tr><tr><td>Get Only</td><td>Worker Data: Organization Information</td></tr><tr><td>Get Only</td><td>Reports: Pay Calculation Results for Worker (Results)</td></tr><tr><td>Get Only</td><td>Worker Data: Payroll</td></tr><tr><td>Get Only</td><td><p><strong>Process: Export Time Blocks</strong></p><p>This is required to retrieve Timesheet Entries</p><p><br></p></td></tr><tr><td>Get Only</td><td>Person Data: Personal Photo</td></tr><tr><td>Get Only</td><td><p>Worker Data: Time Off*</p><p>*Specific instructions to allow access to Time Off data can be found<a href="https://help.merge.dev/en/articles/6346812-time-off-on-workday"> here</a>.</p></td></tr></tbody></table>

{% hint style="success" %}
Refer to the full permissions list based on your use case (HRIS or ATS).
{% endhint %}

Once complete, it should look similar to this:

<figure><img src="/files/LWI9j4GYl7GdOCBcsrIN" alt="" width="563"><figcaption></figcaption></figure>

***

#### Step 4: Activate Security Policy Changes

In the search bar, enter **Activate Pending Security Policy Changes**.

<figure><img src="/files/wzVVl39RwUoOaetLaIWF" alt="" width="563"><figcaption></figcaption></figure>

Review the security policy summary in the pop-up, then confirm the changes.

<figure><img src="/files/78EuoSGYWxPm7Pbff7ks" alt="" width="563"><figcaption></figcaption></figure>

***

#### Step 5: Validate Authentication Policies

Search for **Manage Authentication Policies** in the Search bar.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdnkzEe-MmOF2Q2Fyk6lW9o-SzPRD7NBzKenN0KTpNU4GZfC_DMYwaRk7ACwvDkyxyHwQU-wzFLbSiOp1IiNpjDg54d_vPvov0PVw518gcs6iHcDS0YL8YuqLRCjP687Surr_0mQQ?key=SPxmwHQgNcbr6Jm8Fr50iA" alt="" width="563"><figcaption></figcaption></figure>

Click **Edit** on the authentication policy row to create a new Authentication Policy.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdaym02ExUlGPuc_sX6CUqnqqRu3vnFYCtyRUTYhrNiSdAm6SY_I-eCnM2Jzj6GlyDDMoDMEU9pK7vYWmGWDw-PyhgeMyR51T-pXfertSha-j3rxE0a0SmuolxZcqIbEZxU4kwbEQ?key=SPxmwHQgNcbr6Jm8Fr50iA" alt=""><figcaption></figcaption></figure>

Within this edit menu, click the plus icon (+) to create an authentication rule for the policy.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcK7pTSacXYY1q7G2UMolrZ9niaJ_g_ap2C79ZyUbiXOYr4O-U24cjIH4rznGoYekh2-c1SGbUM53bEhigZzGjkVxKS6boBCXrSM0FqZQ4xX3jBQeRQbSpSImg8SENEOBxYUM4RGg?key=SPxmwHQgNcbr6Jm8Fr50iA" alt=""><figcaption></figcaption></figure>

Enter a **Name** for the policy, add the **Security Group**, and ensure **Allowed Authentication Types** is set to **Specific User Name Password** or **Any**.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXe0sUiFmCICOSb-JXXwLKprxUqiZiIrPUs0uUxm5xG4VmMjEyuNzIN5qIMx3ybDgJK0gKIWFzN1vrr47X7T1s6JuS4cBAo-4EgkipUU7V92QJACGEfn3iS5oqpgZmD-2pE8mQMGJw?key=SPxmwHQgNcbr6Jm8Fr50iA" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
If you already have an existing Authentication Rule set to **User Name Password** or **Any**, there's no need to create a new one. Simply add the ISU you created to that existing rule.

However, if **SAML** is the only option listed under **Allowed Authentication Types**, you will need to create a new rule.
{% endhint %}

***

#### Step 6: Activate Authentication Policy Changes

Search for **Activate All Pending Authentication Policy Changes**.

<figure><img src="/files/SjXsv6E9oV66YpTnbAgs" alt="" width="563"><figcaption></figcaption></figure>

Proceed to the next screen and confirm the changes. This will save the **Authentication Policy** that was just created or edited in the step above.

***

#### Step 7: Obtain Web Services Endpoint URL

Search for **Public Web Services**.

<figure><img src="/files/UqJn0bF53Brolfjmh05a" alt="" width="563"><figcaption></figcaption></figure>

Locate **Human Resources (Public)** for **Workday HRIS**. Click the 3-dot option menu and **Click Web Services** from the menu.

<figure><img src="/files/yzaf012TedYFnReozgVB" alt="" width="563"><figcaption></figcaption></figure>

From **Web Services**, click **View WSDL**, scroll down, and copy the **endpoint URL** as it appears in the WSDL.

<figure><img src="/files/8EeC9i6jY1LALSY5RGg4" alt=""><figcaption></figcaption></figure>

***

### MangoApps Side Setup

#### Step 1: Access Integration Settings

Log in to MangoApps as an admin and navigate to **Admin Portal > Integration > Partner Integration**.

<figure><img src="/files/GIqsfeDCZDljITIdqn0e" alt="" width="563"><figcaption></figcaption></figure>

***

#### Step 2: Add the Workday Integration

Click the **Add Integration** button. In the pop-up menu, search and select **Workday**.

<figure><img src="/files/iNbJkdsi2NoM5Ixa8STk" alt="" width="563"><figcaption></figcaption></figure>

***

#### Step 3: Authenticate and Configure Account

Proceed through the authentication steps and ensure administrative privileges are used.

<figure><img src="/files/FAqsyVU8QmljTZSyYm6Y" alt=""><figcaption></figcaption></figure>

***

#### Step 4: Enter Workday Credentials

Enter the **Integration System User** credentials.

<figure><img src="/files/wiTgaLb2NNgatahz80k7" alt="" width="563"><figcaption></figcaption></figure>

Then, input the **Web Services Endpoint URL** from Workday.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc8l8Q1Z_K0qA9ZzV1P_eD6pPTwBB5JCGUtl6SWCIlewtVjoGG5tF6jPYVkLjdhMGvWGDyTl8ZODPAq-dzhdfF4N1NKA7OhCdzztXwwlSBtWIMEtZJoKnZmhl1cbz_Yq2Q78Xr5?key=SPxmwHQgNcbr6Jm8Fr50iA" alt="" width="375"><figcaption></figcaption></figure>

***

#### Step 5: Initiate User Synchronization

Submit the configuration and MangoApps will begin syncing user data.

***

#### Step 6: Configure Field Mapping

After sync, proceed to **Configure Mapping**.

<figure><img src="/files/SI6VWNTM4CGagmzoM1DW" alt="" width="563"><figcaption></figcaption></figure>

Map default and custom fields between Workday and MangoApps.

<figure><img src="/files/pwLiYTEi231yvZpWXdxc" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="success" %}
If the profile fields you need are not available in the Field Mappings pop-up, you can add custom fields by going to [**Admin Portal > Modules > People > Full Profile**](https://guides.mangoapps.com/admin-guide/module-settings/people/full-profile/managing-profile-fields#adding-a-new-custom-field).

After adding and mapping the custom fields, be sure to **Force Sync** or wait for the next scheduled sync cycle for the changes to take effect in the domain.
{% endhint %}

Save the mapping.

Congratulations! The integration has been completed and will automatically update MangoApps with user data from Workday.

***

### Testing Considerations

* Perform the initial sync in a test environment if possible.
* Validate field mappings and ensure key employee data (e.g., name, email, employment status) is accurately transferred.
* Check for sync errors in the MangoApps admin logs.
* Ensure ISU permissions are not restricted by unforeseen domain or data constraints.

***

### Security Considerations

* Use a strong, non-expiring password for the Integration System User.
* Restrict the ISU’s permissions to only the necessary domain policies.
* Ensure secure storage of credentials and endpoint URL in MangoApps.
* Regularly review the authentication and domain security policies in Workday for compliance.

***

### End User Experience

Once the integration is live:

* End users will see their Workday-sourced profile details (e.g., name, title, department) automatically populated in MangoApps.
* Any updates to employee data in Workday will reflect in MangoApps after each synchronization cycle.
* Users do not need to take any manual action for their profiles to update.

***

### Rollout Recommendations

* **Pilot First**: Begin integration with a small group of users or a test Workday environment.
* **Communicate Clearly**: Inform users and admins about upcoming profile updates and the source of the data.
* **Monitor Sync**: After rollout, monitor the sync logs regularly to ensure consistency and resolve any discrepancies.
* **Schedule Regular Syncs**: Ensure synchronization occurs at defined intervals to keep MangoApps data up to date.
* **Document and Train**: Provide internal documentation and training for admins managing the integration.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://guides.mangoapps.com/integrations-guide/hris-partner-integrations/integration-with-workday.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.