Workday

Sync Workday HR events to trigger intelligent IT provisioning and access management

Workday is an enterprise cloud platform for finance and human resources management. Connecting Workday to Harmony enables automated IT provisioning triggered by HR events, comprehensive employee lifecycle management, and data-driven workforce analytics for IT operations.

What the Workday integration enables

Capability	Description
Automated Provisioning	Trigger IT workflows automatically based on Workday HR events
Employee Lifecycle	Manage onboarding, transfers, and offboarding seamlessly
Organizational Sync	Keep employee data and org structure synchronized across IT systems
Lifecycle Automation	Automate IT tasks for role changes, transfers, and promotions

How It Works

Harmony connects to Workday Web Services (SOAP) as an Integration System User (ISU) using WS-Security. The connection requires exactly four values: Username, Password, Tenant ID, and WSDL URL.

No OAuth is involved. You do not need to register an API Client for Integrations, and there are no client IDs, client secrets, refresh tokens, or API scopes to configure. All access is governed by the domain security policies granted to the ISU's security group.

Prerequisites

• Workday Administrator Access: Admin role with permissions to create Integration System Users (ISUs)
• Permissions to configure security groups and policies
• Harmony Account: Active Harmony workspace with admin privileges

Connect Workday to Harmony

Step 1: Create Integration System User in Workday

1. Log in to your Workday tenant
2. Search for Create Integration System User and fill in:

   • User Name: HarmonyIntegration
   • Password: Create a strong password (no &, <, or > characters)
   • Session Timeout Minutes: 0 (prevents session expiration)
   • Optionally check Do Not Allow UI Sessions to block interactive logins
3. Search for Maintain Password Rules and add the ISU to System Users exempt from password expiration

Step 2: Create Security Group

1. Search for Create Security Group
2. Select Integration System Security Group (Unconstrained) as the type and name it Harmony Integration Group
3. Assign HarmonyIntegration to the new security group

Step 3: Grant Domain Security Policies

1. Search for Maintain Permissions for Security Group and select Harmony Integration Group
2. Add the following domain security policies with Get access:

   • Worker Data: Public Worker Reports
   • Person Data: Name
   • Person Data: Work Contact Information
   • Worker Data: Current Staffing Information
   • Worker Data: Organization Information
   • Worker Data: Workers
   • Worker Data: Time Off (required for syncing employee time-off and availability)
3. Search for Activate Pending Security Policy Changes and confirm

For each domain, make sure Get is ticked under Integration Permissions — not only under the report/task view permissions. Integration Permissions are what govern Workday SOAP web services access; granting only view permissions is the usual cause of 403 errors even when all permissions appear to be granted.

Tip: To look up which functional area a given domain belongs to, run the Domain Security Policies for Functional Area report in Workday.

Step 4: Find Your Connection Details

• Username / Password: The credentials of the HarmonyIntegration ISU created in Step 1
• Tenant ID: The tenant identifier from your Workday URL. For example, if your Workday UI is at https://impl.workday.com/sample_company/d/home.html, your Tenant ID is sample_company. Enter it exactly as it appears in the URL — it is case-sensitive
• WSDL URL: Only the Workday web services host — for example https://wd2-impl-services1.workday.com. To find it, run the Public Web Services report in Workday, select Human Resources (Public) > Web Service > View WSDL, and take just the host part of the WSDL address (everything before /ccx/...)

Do not paste your Workday browser URL or the full /ccx/service/... endpoint into the WSDL URL field. Harmony builds the service path automatically — the field must contain only the host, like https://wd2-impl-services1.workday.com.

Connect your production Workday tenant unless you specifically want sandbox data. URLs containing impl (e.g. impl.workday.com) belong to implementation/sandbox tenants — Harmony will sync whatever tenant the WSDL URL points at.

Step 5: Navigate to Integrations

1. Log into your Harmony dashboard
2. Navigate to Settings > Integrations
3. Find Workday under HRIS and click Connect

Step 6: Enter Credentials

1. Enter your Username (the ISU created in Step 1)
2. Enter your Password
3. Enter your Tenant ID
4. Enter your WSDL URL
5. Click Connect

Once connected, Harmony automatically pulls employee data from your Workday instance to keep your team and agent data synchronized with your support platform.

What Harmony Syncs

From Workday:

• Employee profiles (name, email, employee ID)
• Job information (title, position, job profile)
• Department and cost center
• Manager relationships and organizational hierarchy
• Work location and address
• Employment status and type
• Employment dates (hire date, termination date)
• Time off and availability
• New hire, termination, job change, and transfer events

Use Cases

Day-One Ready Onboarding

Trigger complete IT setup when new employees are added in Workday, ensuring accounts and equipment are ready on day one

Role Change Management

Automatically adjust access when employees change roles or departments in Workday

Seamless Offboarding

Automate access revocation and asset recovery when employees are terminated in Workday

Compliance & Audit

Maintain audit trails linking IT access to Workday employee records for compliance reporting

Troubleshooting

403 errors after connecting

Possible causes:

• The ISU's security group is missing one of the domain security policies from Step 3
• A domain is granted only under the report/task view permissions, without Get ticked under Integration Permissions

Solutions:

1. Re-open Maintain Permissions for Security Group and verify every domain from Step 3 is granted with Get under Integration Permissions
2. Run Activate Pending Security Policy Changes — grants do not take effect until activated

Connection succeeds but no employees appear

Possible causes:

• The WSDL URL contains a path — a Workday browser URL or a full /ccx/service/... endpoint — instead of only the host
• The Tenant ID case doesn't match your Workday URL (it is case-sensitive)
• Permissions were configured on the API Client Scope (Functional Areas) screen, which only governs OAuth access and is not used by this integration — the domains must be granted on the ISU's security group instead
• The domain grants were never activated

Solutions:

1. Grant the Step 3 domains via Maintain Permissions for Security Group on Harmony Integration Group, with Get ticked under Integration Permissions
2. Run Activate Pending Security Policy Changes
3. Data appears on the next scheduled sync — or contact Harmony support to trigger an immediate sync

Employees look wrong or incomplete

Possible causes:

• The WSDL URL points at an implementation (impl) tenant instead of production, or vice versa

Solutions:

1. Verify the WSDL URL host and tenant match the Workday instance you want Harmony to sync from
2. Reconnect the integration with the corrected WSDL URL