> For the complete documentation index, see [llms.txt](https://guides.mangoapps.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://guides.mangoapps.com/integrations-guide/single-sign-on/sso-integrations-by-provider/sso-integrations-for-workday/mangoapps-as-an-sso-provider-for-workday.md).

# MangoApps as an SSO Provider for Workday

### **Overview**

This guide provides step-by-step instructions to configure MangoApps as a **Single Sign-On (SSO)** provider for Workday. This integration allows users to log in to Workday using their MangoApps credentials, improving security and ease of access.

***

### **Required Roles**

To perform the setup successfully, you must have the appropriate administrative access in both systems.

* **MangoApps**: Admin access to the MangoApps Admin Portal
* **Workday**: Administrator privileges to access and edit tenant security settings

***

### **MangoApps Side Setup**

This section explains how to configure the SSO application within MangoApps.

**Log in to MangoApps** as an admin and navigate to **Admin Portal > SSO > Application > MangoApps Provisioned Apps**

<figure><img src="/files/Rso5vGIePAatWqNLhisQ" alt="" width="563"><figcaption></figcaption></figure>

Click the **Add Application** button and search for **Workday**.

<figure><img src="/files/zTpsFMlCXhXtGkAa3iy0" alt="" width="563"><figcaption></figcaption></figure>

Click the **Add** button next to Workday to access the app configurations pop-up menu.

<figure><img src="/files/rI3dpRcYYHl5VYgIP55i" alt="" width="563"><figcaption></figcaption></figure>

From this menu, fill in the required fields:

* **Workday Application URL**: Your Workday Application URL&#x20;
* **Workday ACS URL**: Your Workday Application URL/login-saml.html
* **Entity ID**: e.g. `http://www.workday.com`
* **User Identifier**: Select `Email`, `sAMAccountName`, or `EmployeeID` per your requirement

Save the application.

Download the **Metadata** from the three-dot menu of the configured Workday application to obtain the **x509 certificate**. This certificate will be used during the Workday portion of this setup.

<figure><img src="/files/QxCyqJ09MsQuCBEwy45J" alt="" width="563"><figcaption></figcaption></figure>

***

### **Workday Side Setup**

The following steps outline how to configure Workday to trust MangoApps as its SSO identity provider.

**Sign in to Workday** with admin privileges.

Navigate to **Edit Tenant Setup – Security** by searching for it on the home screen and expand the **Single Sign-On** section.

<figure><img src="/files/s3jX6ihSyxWEQ5919Jhm" alt=""><figcaption></figcaption></figure>

Under **Redirection URLs**, click the **plus icon** and add the following:

* **Login Redirect URL**:\
  `https://<your mangoapps domain>/saml/08904ab0-343f-0137-0224-2f38cb4aeeeb/auth`
* **Logout Redirect URL**:\
  `https://<your mangoapps domain>/saml/08904ab0-343f-0137-0224-2f38cb4aeeeb/logout`
* **Mobile App Login Redirect URL**:\
  `https://<your mangoapps domain>/saml/08904ab0-343f-0137-0224-2f38cb4aeeeb/auth`
* **Mobile Browser Login Redirect URL**:\
  `https://<your mangoapps domain>/saml/08904ab0-343f-0137-0224-2f38cb4aeeeb/logout`

{% hint style="info" %}
All the above redirect URLs can be found in the downloaded SAML metadata from MangoApps. Please open the file in a notepad to retrieve the information.
{% endhint %}

Then, enter an **Environment** name.

Next, scroll to the **SAML Setup** section and enable **SAML Authentication**.

<figure><img src="/files/V11RpPhgT2ZtLJtpmUia" alt=""><figcaption></figcaption></figure>

Add a new **SAML Identity Provider** with the following values:

* **Identity Provider Name**: MangoApps
* **Issuer**: `http://www.workday.com`

For the **x509 Certificate**:

* Click the **horizontal lines** icon an select **Create x509 Public Key**
* Enter a unique name for your certificate (e.g., `MangoApps.cert`)
* Paste the certificate from MangoApps (see MA Side Setup)

After adding the certificate, click **OK** to save. This will return you to the **Edit Tenant Setup - Security** screen.&#x20;

We will need to set a couple more values in order to complete the integration.

Set the following additional values in the **Edit Tenant Setup - Security** screen:

* **Service Provider ID**: `http://www.workday.com`
* Enable **SP-Initiated SAML Authentication**
* **IdP SSO Service URL**: `http://www.workday.com`
* Enable **Always Require IdP Authentication**
* Select **ForceAuthn Only**
* **Authentication Request Signature Method**: SHA256

<figure><img src="/files/APYcwZ6kVrg5JdcnGixx" alt="" width="563"><figcaption></figcaption></figure>

Click **OK** to save.

***

### **Testing Considerations**

After setup, it’s important to test the SSO flow to ensure everything works as expected before rolling it out to end users.

* Use a **test user account** that exists in both MangoApps and Workday.
* Test both **SP-initiated login** (from Workday) and **IdP-initiated login** (from MangoApps).
* Verify the following:
  * Redirection works correctly.
  * User is authenticated using the correct identifier.
  * Access is granted without errors.

***

### **Security Considerations**

When setting up SSO, ensure your configuration meets your organization’s security requirements.

* Use **SHA256** for signature hashing.
* Ensure your MangoApps and Workday tenants are using **HTTPS**.
* Keep the **x509 certificate** secure and rotate it periodically.
* Audit user login activities through MangoApps and Workday logs.

***

### **End User Experience**

Once SSO is enabled, users can access Workday with their MangoApps credentials.

* **From MangoApps**: Users can click the Workday app icon if published on the dashboard or app launcher.
* **From Workday**: Users attempting to log in will be redirected to MangoApps for authentication.
* **Mobile Support**: Both mobile app and browser-based logins are supported through SSO.

***

### **Rollout Recommendations**

To ensure a smooth deployment, follow these steps:

1. **Pilot with a small user group** to validate the configuration.
2. **Document the login process** and provide training resources.
3. Update all relevant **communication channels** before rollout.
4. Monitor login traffic and support tickets during the initial rollout.
5. Plan for **certificate renewal** and revalidation schedules.