> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-workday.md).

# Onboard Workday

SaaS Security connects to Workday using OAuth 2.0 authorization via an API Client for Integrations. To enable secure background scanning, you create a non-human integration system user account and associate it with the API client. SaaS Security also pulls data from a custom report that you expose as a web service.

Onboarding consists of four tasks:

1. Create an Integration System User
2. Register an API Client for Integrations
3. Create a Custom Report
4. Connect SaaS Security to Workday

The onboarding process requires the following credentials:

| Item                                    | Description                                                                                                     |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| Client ID                               | Generated by Workday to uniquely identify the API Client for Integrations you create.                           |
| Client Secret                           | Generated by Workday; used by SaaS Security to authenticate to the API client.                                  |
| Token Endpoint                          | Used by SaaS Security to generate an authentication token.                                                      |
| Refresh Token                           | A persistent token that maintains a secure connection independently of user sessions.                           |
| Custom Audit Log Report Web Service URL | The JSON web service URL for the custom report that SaaS Security uses to pull data from your Workday instance. |

***

#### Task 1 — Create an Integration System User

Create a non-human integration system user account to allow SaaS Security to scan Workday independently of human user sessions.

**Step 1 — Identify the administrator account**

Required permissions: You must have Security Administrator permissions in Workday to create the integration system user.

**Step 2 — Create the integration system user**

1. Log in to the Workday console using the Security Administrator account.
2. In the search field, search for Create Integration System User and select it from the results.
3. On the Create Integration System User page, specify a username and password.
4. Select the Do Not Allow UI Sessions checkbox for enhanced security.
5. Click OK.

**Step 3 — Create a security group for the integration system user**

1. Search for Create Security Group and select it from the results.
2. On the Create Security Group page:
3. From the Type of Tenanted Security Group drop-down, select Integration System Security Group (Unconstrained).
4. Enter a name for the security group and click OK.
5. On the Integration System Security Group (Unconstrained) page:
6. In the Integration System Users field, select the integration system user you created.
7. Click OK.

**Step 4 — Assign domain security policy permissions**

1. Search for Maintain Permissions for Security Group and select it from the results.
2. On the Maintain Permissions for Security Group page:
3. Set Operation to Maintain.
4. Set Source Security Group to the security group you created.
5. Click OK.
6. On the second Maintain Permissions for Security Group page:
7. Select the Domain Security Policy Permissions tab.
8. Add the following domain security policies with View Only access:

| Domain Security Policy             | Access    |
| ---------------------------------- | --------- |
| Workday Accounts                   | View Only |
| Worker Data: Public Worker Reports | View Only |
| Security Administration            | View Only |
| Security Configuration             | View Only |
| System Auditing                    | View Only |

**Step 5 — Activate pending security policy changes**

1. Search for Activate Pending Security Policy Changes and select it from the results.
2. Enter a comment describing the changes and click OK.
3. On the confirmation page, select the Confirm checkbox and click OK.

***

#### Task 2 — Register an API Client for Integrations

Required permissions: You must have Security Administrator permissions in Workday.

1. Log in to the Workday console using the Security Administrator account.
2. Search for Register API Client for Integrations and select it from the results.
3. On the Register API Client for Integrations page, complete the following fields:

| Field                           | Value                                                                                                                                                   |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Client Name                     | A unique name — for example, SaaS\_Security\_Integration\_Client.                                                                                       |
| Refresh Token Timeout (in days) | The number of days the refresh token is valid — for example, 365. Do not select Non-Expiring Refresh Tokens.                                            |
| Scope (Functional Areas)        | Select Tenant Non-Configurable and System. Verify that Workday Query Language appears under the Includes Domains column for the System functional area. |
| Include Workday Owned Scope     | Select this checkbox.                                                                                                                                   |

4. Click OK. Workday registers the API client and displays the Client ID and Client Secret.
5. Copy the Client ID and Client Secret and save them to a text file.

**Note**: Do not proceed until you have copied both values. You must provide them during onboarding.

6. Generate a Refresh Token for the integration system user:
   1. On the Edit API Client for Integrations page, click the ellipsis (...) next to the client name.
   2. Select API Client > Manage Refresh Tokens for Integrations.
   3. In the Workday Account field, select the integration system user you created and click OK.
   4. On the Delete or Regenerate Refresh Token page, select Generate New Refresh Token and Confirm Delete.
   5. Click OK.
   6. Copy the Refresh Token and save it to a text file.

**Note**: Do not proceed until you have copied the Refresh Token.

7. Get the Token Endpoint:
   1. Search for View API Clients and select it from the results.
   2. On the View API Clients page, copy the Token Endpoint value and save it to a text file.

**Note**: Do not proceed until you have copied the Token Endpoint.

***

#### Task 3 — Create a Custom Report

SaaS Security pulls data from a custom report exposed as a web service. Complete the following steps using the Workday Security Administrator account.

1. Search for Create Custom Report and select it from the results.
2. On the Create Custom Report page:
   1. Enter a Report Name.
   2. Select Advanced from the Report Type list.
   3. Select the Enable As Web Service and Optimized for Performance checkboxes.
   4. Set Data Source to Processed Transactions for Range, System Account, Task and Business Object.
   5. Click OK.
3. On the Edit Custom Report page, select the Columns tab and add the following columns:

| Business Object         | Field                 | Column Heading Override XML Alias |
| ----------------------- | --------------------- | --------------------------------- |
| Processed Transaction   | Classes Updated       | Classes\_Updated                  |
| Processed Transaction   | Instances Updated     | Instances\_Updated                |
| Processed Transaction   | Secured Task Executed | Task\_Behavior                    |
| Processed Transaction   | Entry Moment          | Entry\_Moment                     |
| Processed Transaction   | Secured Task Executed | Secured\_Task\_Executed           |
| Processed Transaction   | Processed Transaction | Processed\_Transaction            |
| Processed Transaction   | System Account        | System\_Account                   |
| Attributes that Changed | Changed Attribute     | Changed\_Attribute                |
| Attributes that Changed | Previous Value        | Previous\_Value                   |
| Attributes that Changed | Value                 | Value                             |

4. Under Group Column Headings, add the Attributes that Changed business object.
5. Select the Filters tab and add filters for the Task Behavior field. Add an Or condition for each of the following values (operator: exact match with the selection list, type: Value specified in this filter):

* Edit Tenant Setup - HCM
* Edit Tenant Setup - Global
* Edit Tenant Setup - Security
* Edit Tenant Setup - System
* Edit Tenant Setup - Reporting and Analytics
* Edit Tenant Setup - Recruiting
* Edit Tenant Setup - Payroll
* Edit Tenant Setup - Integrations

6. Select the Prompts tab:

* Select the Display Prompt Values in Subtitle checkbox.
* Add the following prompts (mark From Moment and To Moment as Required):

| Field           | Label For Prompt XML Alias | Required    |
| --------------- | -------------------------- | ----------- |
| From Moment     | From\_Moment               | Yes         |
| To Moment       | To\_Moment                 | Yes         |
| Business Object | Business\_Object           | <p><br></p> |
| Task            | Task                       | <p><br></p> |
| Workday Account | Workday\_Account           | <p><br></p> |

**Note**: If the Business Object and Workday Account fields are not available, select Populate Undefined Prompt Defaults to add them.

7. Select the Share tab and configure the following sharing options:

| Field                             | Value                                                          |
| --------------------------------- | -------------------------------------------------------------- |
| Report Definition Sharing Options | Share with specific authorized groups and users                |
| Authorized Groups                 | The security group you created for the integration system user |
| Authorized Users                  | The integration system user you created                        |

8. On the Sort tab, do not add or modify any fields. The Sort tab must remain in its default state.
9. Click OK to save the report.
10. Get the web service URL:
    1. In the banner of the Create Custom Report page, click the ellipsis (...) next to the report name and select Web Service > View URLs.
    2. On the View URLs Web Service page, locate the JSON section.
    3. Copy the JSON URL and save it to a text file.

Note: Do not proceed until you have copied the JSON web service URL.

***

#### Task 4 — Connect SaaS Security to Workday

1. Log in to [Cortex](https://cortex.paloaltonetworks.com).
2. Select **Settings > Data Sources and Integrations > Add New** and click the Workday tile.
3. On the **Capabilities** tab, enter a name for this instance.
4. Under Default Capabilities, confirm Security Posture is selected.
5. Click Next.
6. On the **Connections** tab, select Log in with Credentials.
7. Enter the following values:

* Client ID
* Client Secret
* Token Endpoint
* Refresh Token
* Custom Audit Log Report Web Service URL (JSON format)

8. Click Next.
9. On the Configurations tab:
   1. Set the Sync Interval.
   2. (Optional) Add a Tag.
10. Click Next to complete onboarding.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/saas-security/saas-security/onboard-a-supported-saas-application/onboard-workday.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.