> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Learn how to connect your Workday tenant to Opal.

Opal's integration with Workday lets you [leverage HRIS data](https://docs.opal.dev/integrations/workday-idphris-integration.md) as an additional source of truth for users, employee metadata, and their attributes. The integration also allows you to manage access to entitlements such as [Workday Security Groups and Roles](https://docs.opal.dev/integrations/workday-groups-and-roles.md).

## Supported resources

| Resource | Read | Grant and revoke access | Available in [Risk Center](https://docs.opal.dev/docs/least-privilege-posture-management.md) |
| - | - | - | - |
| Workday Users and user attributes (as HRIS) | ✔️ | | ✔️ |
| Workday User Security Groups | ✔️ | ✔️ | ✔️ |
| Workday Roles | ✔️ | ✔️ | ✔️ |

The Workday integration does not currently support syncing Workday service users.

## 1. Create an Opal app

To get started, go to the **Inventory** > **Apps** page, select **+App** at the top right, and select **+Connect** under the **Workday** tile.

![2312](https://mintcdn.com/opalsecurity/odnvD_MsXBxTor9u/images/docs/8d504c08cb84637c4803fd3a5d8f07dd167944c6b30ce1c7ddcba62b3589bad5-opal-101-apps-add-app.png?fit=max\&auto=format\&n=odnvD_MsXBxTor9u\&q=85\&s=4d0b816135e43b5430e68c44edd8128c)

Because Workday configures permissions on the field level, the set up process involves creating a **Workday Integration System User** and **Workday Integration Security Group** to ensure it has the necessary permissions.

## 2. Create an Integration System User (ISU)

In the Workday Search bar, enter **Create Integration System User**, and select the corresponding **Task**.

![2312](https://mintcdn.com/opalsecurity/lwwIeFbsleftxaXx/images/docs/c28350a-Screenshot_2024-08-08_at_10.41.06_AM.png?fit=max\&auto=format\&n=lwwIeFbsleftxaXx\&q=85\&s=132022dbed3196a60e13747e4a89ced9)

In the **Create Integration System User** modal, enter the **Account Information**, including User Name, Password. Set the **Session Timeout Minutes** to 0 to prevent session expiry, as it may lead to the integration timing out before completion.

![2312](https://mintcdn.com/opalsecurity/4Xj9diJ3E3kX-9Xd/images/docs/e75c96c-Screenshot_2024-08-08_at_10.42.29_AM.png?fit=max\&auto=format\&n=4Xj9diJ3E3kX-9Xd\&q=85\&s=6caf95949a75f9d152aef1c07dcbaab9)

## 3. Create a Security Group and assign it an ISU

In the Workday Search bar, enter **Create Security Group**, and select the corresponding Task.

![2312](https://mintcdn.com/opalsecurity/fu-nWazMe1LxLhxi/images/docs/3760765-Screenshot_2024-08-08_at_10.38.48_AM.png?fit=max\&auto=format\&n=fu-nWazMe1LxLhxi\&q=85\&s=116c8d5313f5d8573ae5b7e694e27639)

In the Create Security Group modal, for the Type of Tenanted Security Group, select **Integration System Security Group (Unconstrained)** and enter a name to represent the ISU.

![2312](https://mintcdn.com/opalsecurity/lwwIeFbsleftxaXx/images/docs/c7e1e2c-Screenshot_2024-08-08_at_10.44.10_AM.png?fit=max\&auto=format\&n=lwwIeFbsleftxaXx\&q=85\&s=49db1bdd4af86529232206ab9a3200e6)

Once created, Edit the Security Group to associate it with the **Integration System User** you created in Step 2.

![2312](https://mintcdn.com/opalsecurity/lwwIeFbsleftxaXx/images/docs/bc7be54-Screenshot_2024-08-08_at_10.54.09_AM.png?fit=max\&auto=format\&n=lwwIeFbsleftxaXx\&q=85\&s=7724df7ee017b2d517f750053767845b)

## 4. Configure Domain Security Policy Permissions

In the Workday Search bar, enter **Maintain Permissions for Security Group**, and select the corresponding Task.

![2312](https://mintcdn.com/opalsecurity/TlQj9FwRe9HHNEYB/images/docs/0dc8eee-Screenshot_2024-08-08_at_10.55.08_AM.png?fit=max\&auto=format\&n=TlQj9FwRe9HHNEYB\&q=85\&s=57f257f31b9730c30238eb293dfb2f9d)

In the task modal, first set the **Operation** to **Maintain** and set the **Source Security Group** to the Security Group you created in Step 3.

![2312](https://mintcdn.com/opalsecurity/KunPWigry5GIeB5g/images/docs/4454c3a-Screenshot_2024-08-08_at_10.56.01_AM.png?fit=max\&auto=format\&n=KunPWigry5GIeB5g\&q=85\&s=840572067d192b66dfc3c32f6be03f01)

Then, edit the **Domain Security Policy Permissions** and add the following GET ONLY operations:

| View/Modify Access | Domain Security Policy | Required | Reason |
| - | - | - | - |
| GET ONLY | Worker Data: Public Worker Reports | Required | Used to import users within resources |
| GET ONLY | Worker Data: Workers | Required | Used to import users within resources |
| GET ONLY | Security Configuration | Required | Used to check for permissions |
| GET ONLY | Worker Data: Current Staffing Information | Required if you use Workday as your IDP/HRIS | Used to retrieve user statuses |
| GET ONLY | Integration Build | Required if you use Workday as your IDP/HRIS | Used to retrieve user statuses |
| GET ONLY | Worker Data: Employment Data | Required if you use Workday as your IDP/HRIS | Used to import user attributes |
| GET ONLY | Worker Data: All Positions | Required if you use Workday as your IDP/HRIS | Used to import user attributes |

In Workday, you can add each by clicking on the **+** button on the top left of the table. For example:

![2312](https://mintcdn.com/opalsecurity/fu-nWazMe1LxLhxi/images/docs/2cb8fd3-Screenshot_2024-08-08_at_2.34.56_PM.png?fit=max\&auto=format\&n=fu-nWazMe1LxLhxi\&q=85\&s=121fc4563404b105da17295cad16c8df)

## 5. Activate Security Policy Changes

In the Workday Search bar, enter **Activate Pending Security Policy Changes**, and select the corresponding Task.

![2312](https://mintcdn.com/opalsecurity/lt0M-hBs5yNe5ff5/images/docs/98e45f7-Screenshot_2024-08-08_at_11.30.26_AM.png?fit=max\&auto=format\&n=lt0M-hBs5yNe5ff5\&q=85\&s=ce69459cc0fc214558a8e6b32e66b7a6)

Review and check the **Confirm** box to activate the Security Policy Changes.

![2312](https://mintcdn.com/opalsecurity/lt0M-hBs5yNe5ff5/images/docs/9fe4883-Screenshot_2024-08-08_at_2.50.22_PM.png?fit=max\&auto=format\&n=lt0M-hBs5yNe5ff5\&q=85\&s=01735d18faf60c7dbe662c3746e349a4)

## 6. Manage Authentication Policies

In the Workday Search bar, enter **Manage Authentication Policies**, and select the corresponding Report.

![2312](https://mintcdn.com/opalsecurity/lt0M-hBs5yNe5ff5/images/docs/b0a0c53-Screenshot_2024-08-08_at_11.35.09_AM.png?fit=max\&auto=format\&n=lt0M-hBs5yNe5ff5\&q=85\&s=27ca699006818c7ca0eabfa59f6eef99)

Depending on your policy set up, you can choose to edit an existing policy or create a new one.

To create a new one:

1. select **Add Authentication Policy** on the page.
2. Select from the dropdown the corresponding **Environment** you would like the policy to apply to.
3. In the table below, add an **Authentication Ruleset** by selecting the **+** button on the top left.
4. Provide an **Authentication Rule Name** and set the **Security Group** to the one you created in Step 2. For the **Authentication Conditions**, select **Any**. For **Allowed Authentication Types**, select **User Name Password**.

![2312](https://mintcdn.com/opalsecurity/4Xj9diJ3E3kX-9Xd/images/docs/db53a40-Screenshot_2024-08-08_at_11.43.04_AM.png?fit=max\&auto=format\&n=4Xj9diJ3E3kX-9Xd\&q=85\&s=3d3b5dcf7688e49fd9a20595c9879229)

## 7. Activate All Pending Authentication Policy Changes

In the Workday Search bar, enter **Activate All Pending Authentication Policy Changes**, and select the corresponding Task.

![2312](https://mintcdn.com/opalsecurity/KunPWigry5GIeB5g/images/docs/40b3c1d-Screenshot_2024-08-08_at_3.04.13_PM.png?fit=max\&auto=format\&n=KunPWigry5GIeB5g\&q=85\&s=3942f8cd9fa5e16a35f04adaf9ce7271)

Add any comments, review, and check the **Confirm** box to activate the Authentication Policy Changes

![2312](https://mintcdn.com/opalsecurity/odnvD_MsXBxTor9u/images/docs/7dfed4a-Screenshot_2024-08-08_at_3.04.56_PM.png?fit=max\&auto=format\&n=odnvD_MsXBxTor9u\&q=85\&s=72d3504c428c4cb519acc42192e7fcb2)

## 8. Obtain the Web Services Endpoint for tenant

In the Workday Search bar, enter **Public Web Services**, and select the corresponding Report.

![2312](https://mintcdn.com/opalsecurity/E-CmJXh0QNjZUl4g/images/docs/6929615-Screenshot_2024-08-08_at_3.08.10_PM.png?fit=max\&auto=format\&n=E-CmJXh0QNjZUl4g\&q=85\&s=79366cc60516e17c8d069033919c234c)

In the table, locate the **Human Resources (Public)** Web Service, hover over it and click on the **...** to the right of the text. Under **Web Service**, select **View WSDL**. This will open another page in the browser.

![2312](https://mintcdn.com/opalsecurity/KunPWigry5GIeB5g/images/docs/41f75db-Screenshot_2024-08-08_at_11.46.55_AM.png?fit=max\&auto=format\&n=KunPWigry5GIeB5g\&q=85\&s=6b64f4776c41182ee9634d3d19c1c428)

In the new page containing the document tree, you can use Cmd + F / Ctrl + F to find `/service`, and you should see a URL address that looks like the following:

![2312](https://mintcdn.com/opalsecurity/E-CmJXh0QNjZUl4g/images/docs/5ae1dbd-Screenshot_2024-08-08_at_11.48.28_AM.png?fit=max\&auto=format\&n=E-CmJXh0QNjZUl4g\&q=85\&s=945e7f59e5000496080fad5686538414)

The corresponding highlighted URL segment up to the `/service` path is your **Workday Web Services Endpoint**. Note that each tenant may have a different endpoint, so a new endpoint would need to be created for each environment you would like to connect. The text directly after `/service` should represent your **Workday Tenant Name**. As an example, if your Workday log in URL is `https://impl.workday.com/HelloWorld`, your Workday Tenant Name would be `HelloWorld`.

## 9. Complete the Opal form to connect Workday

In Opal, enter the details based on the Workday items you configured in the previous steps:

* App name, App admin, and Description
* Workday Integration System User username (Step 2)
* Workday Integration System User password (Step 2)
* Workday tenant URL hostname (Step 8, e.g., `wd2-impl-services1.workday.com`)
* Workday tenant name (Step 8)
* Security Group Name (optional—the Security Group attached to Opal's Integration System User in Step 3)
* Custom user attributes (optional—if enabled, enter the **Workday Integration System ID**)

![2312](https://mintcdn.com/opalsecurity/fu-nWazMe1LxLhxi/images/docs/23fc33f-Screenshot_2024-08-08_at_1.45.51_PM.png?fit=max\&auto=format\&n=fu-nWazMe1LxLhxi\&q=85\&s=a36203c818428fed98abf98ec7e49b16)

Once you've completed the form, select **Create**, and your connection should be set up and running.

See [Workday Groups and Rules](https://docs.opal.dev/integrations/workday-groups-and-roles.md) to learn how to manage access to Workday entities such as User Security Groups and Organization Roles, and the [Workday IDP/HRIS Integration](https://docs.opal.dev/integrations/workday-idphris-integration.md) guide to learn how to sync Workday entities and attributes.

## Run app validation checks

After you save your app, you can view existing sync issues from the **Setup** tab on the app detail page. Missing permissions and sync issues show in the **App Validations** section. Select the refresh icon to rerun validation checks.

![](https://mintcdn.com/opalsecurity/4Xj9diJ3E3kX-9Xd/images/docs/efb2b39c7496b8b1c0c3117c658987fda980b4596eba6a5ef080f93ca9295d99-connection-health-ux.png?fit=max\&auto=format\&n=4Xj9diJ3E3kX-9Xd\&q=85\&s=7b71a4aa2667491ac0427de7b77e176c)

You can hover over the validation icons to learn why Opal needs a given permission. To correctly sync your app to Opal, ensure you address any sync errors, marked with the red ! icon. Inspect warnings on a case-by-case basis: warnings might impact features you’re not using and may be safely ignored, but this depends on your use case.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.