> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/hris/workday.md).

# Workday

Sync Workday HR events to trigger intelligent IT provisioning and access management

Workday is an enterprise cloud platform for finance and human resources management. Connecting Workday to Harmony enables automated IT provisioning triggered by HR events, comprehensive employee lifecycle management, and data-driven workforce analytics for IT operations.

#### What the Workday integration enables

| Capability             | Description                                                         |
| ---------------------- | ------------------------------------------------------------------- |
| Automated Provisioning | Trigger IT workflows automatically based on Workday HR events       |
| Employee Lifecycle     | Manage onboarding, transfers, and offboarding seamlessly            |
| Organizational Sync    | Keep employee data and org structure synchronized across IT systems |
| Lifecycle Automation   | Automate IT tasks for role changes, transfers, and promotions       |

#### How It Works

Harmony connects to Workday Web Services (SOAP) as an **Integration System User (ISU)** using WS-Security. The connection requires exactly four values: **Username**, **Password**, **Tenant ID**, and **WSDL URL**.

{% hint style="info" %}
No OAuth is involved. You do **not** need to register an API Client for Integrations, and there are no client IDs, client secrets, refresh tokens, or API scopes to configure. All access is governed by the domain security policies granted to the ISU's security group.
{% endhint %}

#### Prerequisites

* **Workday Administrator Access**: Admin role with permissions to create Integration System Users (ISUs)
* **Permissions to configure security groups and policies**
* **Harmony Account**: Active Harmony workspace with admin privileges

#### Connect Workday to Harmony

**Step 1: Create Integration System User in Workday**

1. Log in to your Workday tenant
2. Search for **Create Integration System User** and fill in:
   * **User Name**: `HarmonyIntegration`
   * **Password**: Create a strong password (no `&`, `<`, or `>` characters)
   * **Session Timeout Minutes**: `0` (prevents session expiration)
   * Optionally check **Do Not Allow UI Sessions** to block interactive logins
3. Search for **Maintain Password Rules** and add the ISU to **System Users exempt from password expiration**

**Step 2: Create Security Group**

1. Search for **Create Security Group**
2. Select **Integration System Security Group (Unconstrained)** as the type and name it `Harmony Integration Group`
3. Assign `HarmonyIntegration` to the new security group

**Step 3: Grant Domain Security Policies**

1. Search for **Maintain Permissions for Security Group** and select `Harmony Integration Group`
2. Add the following domain security policies with **Get** access:
   * Worker Data: Public Worker Reports
   * Person Data: Name
   * Person Data: Work Contact Information
   * Worker Data: Current Staffing Information
   * Worker Data: Organization Information
   * Worker Data: Workers
   * Worker Data: Time Off (required for syncing employee time-off and availability)
3. Search for **Activate Pending Security Policy Changes** and confirm

{% hint style="warning" %}
For each domain, make sure **Get** is ticked under **Integration Permissions** — not only under the report/task view permissions. Integration Permissions are what govern Workday SOAP web services access; granting only view permissions is the usual cause of 403 errors even when all permissions appear to be granted.
{% endhint %}

> **Tip:** To look up which functional area a given domain belongs to, run the **Domain Security Policies for Functional Area** report in Workday.

**Step 4: Find Your Connection Details**

* **Username** / **Password**: The credentials of the `HarmonyIntegration` ISU created in Step 1
* **Tenant ID**: The tenant identifier from your Workday URL. For example, if your Workday UI is at `https://impl.workday.com/sample_company/d/home.html`, your Tenant ID is `sample_company`. Enter it exactly as it appears in the URL — it is case-sensitive
* **WSDL URL**: Only the Workday web services **host** — for example `https://wd2-impl-services1.workday.com`. To find it, run the **Public Web Services** report in Workday, select **Human Resources (Public)** > **Web Service** > **View WSDL**, and take just the host part of the WSDL address (everything before `/ccx/...`)

{% hint style="warning" %}
Do not paste your Workday browser URL or the full `/ccx/service/...` endpoint into the WSDL URL field. Harmony builds the service path automatically — the field must contain only the host, like `https://wd2-impl-services1.workday.com`.
{% endhint %}

{% hint style="warning" %}
Connect your **production** Workday tenant unless you specifically want sandbox data. URLs containing `impl` (e.g. `impl.workday.com`) belong to implementation/sandbox tenants — Harmony will sync whatever tenant the WSDL URL points at.
{% endhint %}

**Step 5: Navigate to Integrations**

1. Log into your Harmony dashboard
2. Navigate to **Settings** > **Integrations**
3. Find **Workday** under **HRIS** and click **Connect**

**Step 6: Enter Credentials**

1. Enter your **Username** (the ISU created in Step 1)
2. Enter your **Password**
3. Enter your **Tenant ID**
4. Enter your **WSDL URL**
5. Click **Connect**

Once connected, Harmony automatically pulls employee data from your Workday instance to keep your team and agent data synchronized with your support platform.

#### What Harmony Syncs

**From Workday:**

* Employee profiles (name, email, employee ID)
* Job information (title, position, job profile)
* Department and cost center
* Manager relationships and organizational hierarchy
* Work location and address
* Employment status and type
* Employment dates (hire date, termination date)
* Time off and availability
* New hire, termination, job change, and transfer events

#### Use Cases

<details>

<summary>Day-One Ready Onboarding</summary>

Trigger complete IT setup when new employees are added in Workday, ensuring accounts and equipment are ready on day one

</details>

<details>

<summary>Role Change Management</summary>

Automatically adjust access when employees change roles or departments in Workday

</details>

<details>

<summary>Seamless Offboarding</summary>

Automate access revocation and asset recovery when employees are terminated in Workday

</details>

<details>

<summary>Compliance &#x26; Audit</summary>

Maintain audit trails linking IT access to Workday employee records for compliance reporting

</details>

#### Troubleshooting

<details>

<summary>403 errors after connecting</summary>

**Possible causes:**

* The ISU's security group is missing one of the domain security policies from Step 3
* A domain is granted only under the report/task view permissions, without **Get** ticked under **Integration Permissions**

**Solutions:**

1. Re-open **Maintain Permissions for Security Group** and verify every domain from Step 3 is granted with **Get** under **Integration Permissions**
2. Run **Activate Pending Security Policy Changes** — grants do not take effect until activated

</details>

<details>

<summary>Connection succeeds but no employees appear</summary>

**Possible causes:**

* The **WSDL URL** contains a path — a Workday browser URL or a full `/ccx/service/...` endpoint — instead of only the host
* The **Tenant ID** case doesn't match your Workday URL (it is case-sensitive)
* Permissions were configured on the API Client **Scope (Functional Areas)** screen, which only governs OAuth access and is not used by this integration — the domains must be granted on the ISU's security group instead
* The domain grants were never activated

**Solutions:**

1. Grant the Step 3 domains via **Maintain Permissions for Security Group** on `Harmony Integration Group`, with **Get** ticked under **Integration Permissions**
2. Run **Activate Pending Security Policy Changes**
3. Data appears on the next scheduled sync — or contact Harmony support to trigger an immediate sync

</details>

<details>

<summary>Employees look wrong or incomplete</summary>

**Possible causes:**

* The WSDL URL points at an implementation (`impl`) tenant instead of production, or vice versa

**Solutions:**

1. Verify the WSDL URL host and tenant match the Workday instance you want Harmony to sync from
2. Reconnect the integration with the corrected WSDL URL

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.harmony.io/integrations/hris/workday.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.