Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsCloud Collectors Administration Guide

Prerequisites to Configure the Workday Cloud Collector

Before you can configure the Workday cloud collector, complete the following prerequisites.

  • Enable user activity logging for the tenant.

  • Create an Integration System account and user (ISU).

  • Create an Integration System Security Group (ISSG).

    • Link the ISU to the Security Group (ISSG).

    • Assign Domain Security Policies.

    • Activate Security Changes.

  • Register an API client and generate a Refresh token.

  • Obtain the hostname and tenant name.

Enable User Activity Logging

Use the following steps to enable user activity logging for your tenant—your organization's Workday account, and facilitate data collection for the Workday Cloud collector for monitoring.

  1. Log in to Workday as an administrator with your registered credentials.

  2. Search for and access the Edit Tenant Setup - System task.

  3. Select the Enable User Activity Logging option.

  4. Search for and access the Edit Tenant Setup - Security task.

  5. Select the OAuth 2.0 Clients Enabled option.

Create the Integration System User

Use the following steps to create an integration system user (ISU)

  1. Log in to Workday as an administrator with your registered credentials.

  2. Search for and access the Create Integration System User task.

  3. Under Account Information, specify details such as user name, and a password for the user.

  4. Set the session timeout minutes to 0.

  5. Select the Do Not Allow UI Sessions check box to disable interactive UI sessions for the user you created.

    Note

    To avoid integration errors caused by password expiration, access the Maintain Password Rules task, and add the ISU to the System Users exempt from password expiration list.

  6. Click OK to save the configuration.

Create an Integration System Security Group (ISSG)

For cloud collector and Workday integration, ensure that you create a security group and assign the required domain security policies to that group.

  1. Log in to Workday as an administrator with your registered credentials.

  2. Search for and access the Create Security Group task.

  3. Select the group type Integration System Security Group (Unconstrained).

  4. Specify a name for the group and click Ok.

  5. Click OK to save the configuration.

  6. Assign the ISU and the domain security policies to the security group as follows.

Link ISU to Security Group (ISG)

Within the Create Security Group task, add the ISU account you created to the Integration System Users field. You can also assign the ISU account you created to your new security group by editing the created group.

Assign Domain Security Policies

Assign permissions to your new security group that you just created. In Workday, you grant access by linking domain policies to security groups, which you then assign to users.

Use the following quick tips to assign Domain Security Policies. First you link your Security Groups to specific domains and then activate the security policy changes.

  1. Search for and run the Security Group Membership and Access report.

  2. Click the security group you want to modify.

  3. Click the (...) icon next to the group name and navigate to Security Group > Maintain Domain Permissions for Security Group.

    • Add domain security policies to the Report/Task Permissions section for UI access (tasks/reports) with the appropriate view or modify access levels.

    • Set up the Integration Permissions by adding the required domain security policies with the appropriate view or modify access levels.

  4. Activate the changes as follows.

Activate Security Changes

In Workday, all security changes with new permissions remain pending until manually activated by an authorized user. For the Security policy changes to take effect immediately, run the Activate Pending Security Policy Changes task. Workday displays a list of changes that were made to the security polices. Confirm the changes by selecting Confirm and clicking OK.

Register an API Client

Use the following steps to register the API client.

  1. Log in to Workday as an administrator with your registered credentials.

  2. Search for and access the Register API Client for Integration task.

  3. Provide specify the following required information.

    • Client Name – Specify a name for the collector.

    • Refresh Token TimeOut – The value is set to 0 by default.

    • Non-Expiring Refresh Tokens – Select the check box to enable this option.

    • Scope – Add the required scopes such as System.

  4. Click Ok.

  5. Record and save securely the Client Secret and Client ID before you navigate away from the page.

    If you want to re-generate the client ID and client secret, click the (...) icon next to the newly created API Client name and navigate to API Client > Manage Refresh Tokens for Integrations, enter the ISU name for the Workday account and select the Regenerate New Refresh Token option. Click Ok. Note the newly generated Client Secret and Client ID.

Obtain the Hostname and Tenant Name

Use the following steps to obtain the hostname and tenant name to use it while configuring the Workday cloud collector.

  1. Log in to Workday as an administrator with your registered credentials.

  2. Search for and access the View API Clients task.

  3. Locate the Workday REST API Endpoint field under API Clients for Integrations.

  4. Note the Workday REST API Endpoint URL which is typically displayed in the header or as a specific field at the top of the tab. Hostname is the domain of your Workday API endpoint, for example, https://wd5-impl-services1.workday.com/ccx/api/v1/abc_preview

    The basic URL structure is https://{host}/ccx/api/v1/{tenant}/{resource}. Hence in this example, the host name is wd5-impl-services1.workday.com and the tenant name is abc_preview.

  5. Note the hostname and the tenant name to use it while configuring the cloud collector.