Onboard Workday

Connect a Workday instance to detect posture risks and compliance violations.

SaaS Security connects to Workday using OAuth 2.0 authorization via an API Client for Integrations. To enable secure background scanning, you create a non-human integration system user account and associate it with the API client. SaaS Security also pulls data from a custom report that you expose as a web service.

Onboarding consists of four tasks:

1. Create an Integration System User
2. Register an API Client for Integrations
3. Create a Custom Report
4. Connect SaaS Security to Workday

The onboarding process requires the following credentials:

Item	Description
Client ID	Generated by Workday to uniquely identify the API Client for Integrations you create.
Client Secret	Generated by Workday; used by SaaS Security to authenticate to the API client.
Token Endpoint	Used by SaaS Security to generate an authentication token.
Refresh Token	A persistent token that maintains a secure connection independently of user sessions.
Custom Audit Log Report Web Service URL	The JSON web service URL for the custom report that SaaS Security uses to pull data from your Workday instance.

---

Task 1 — Create an Integration System User

Create a non-human integration system user account to allow SaaS Security to scan Workday independently of human user sessions.

Step 1 — Identify the administrator account

Required permissions: You must have Security Administrator permissions in Workday to create the integration system user.

Step 2 — Create the integration system user

1. Log in to the Workday console using the Security Administrator account.
2. In the search field, search for Create Integration System User and select it from the results.
3. On the Create Integration System User page, specify a username and password.
4. Select the Do Not Allow UI Sessions checkbox for enhanced security.
5. Click OK.

Step 3 — Create a security group for the integration system user

1. Search for Create Security Group and select it from the results.
2. On the Create Security Group page:
3. From the Type of Tenanted Security Group drop-down, select Integration System Security Group (Unconstrained).
4. Enter a name for the security group and click OK.
5. On the Integration System Security Group (Unconstrained) page:
6. In the Integration System Users field, select the integration system user you created.
7. Click OK.

Step 4 — Assign domain security policy permissions

1. Search for Maintain Permissions for Security Group and select it from the results.
2. On the Maintain Permissions for Security Group page:
3. Set Operation to Maintain.
4. Set Source Security Group to the security group you created.
5. Click OK.
6. On the second Maintain Permissions for Security Group page:
7. Select the Domain Security Policy Permissions tab.
8. Add the following domain security policies with View Only access:

Domain Security Policy	Access
Workday Accounts	View Only
Worker Data: Public Worker Reports	View Only
Security Administration	View Only
Security Configuration	View Only
System Auditing	View Only

Step 5 — Activate pending security policy changes

1. Search for Activate Pending Security Policy Changes and select it from the results.
2. Enter a comment describing the changes and click OK.
3. On the confirmation page, select the Confirm checkbox and click OK.

---

Task 2 — Register an API Client for Integrations

Required permissions: You must have Security Administrator permissions in Workday.

1. Log in to the Workday console using the Security Administrator account.
2. Search for Register API Client for Integrations and select it from the results.
3. On the Register API Client for Integrations page, complete the following fields:

Field	Value
Client Name	A unique name — for example, SaaS_Security_Integration_Client.
Refresh Token Timeout (in days)	The number of days the refresh token is valid — for example, 365. Do not select Non-Expiring Refresh Tokens.
Scope (Functional Areas)	Select Tenant Non-Configurable and System. Verify that Workday Query Language appears under the Includes Domains column for the System functional area.
Include Workday Owned Scope	Select this checkbox.

1. Click OK. Workday registers the API client and displays the Client ID and Client Secret.
2. Copy the Client ID and Client Secret and save them to a text file.

Note: Do not proceed until you have copied both values. You must provide them during onboarding.

1. Generate a Refresh Token for the integration system user:

   1. On the Edit API Client for Integrations page, click the ellipsis (...) next to the client name.
   2. Select API Client > Manage Refresh Tokens for Integrations.
   3. In the Workday Account field, select the integration system user you created and click OK.
   4. On the Delete or Regenerate Refresh Token page, select Generate New Refresh Token and Confirm Delete.
   5. Click OK.
   6. Copy the Refresh Token and save it to a text file.

Note: Do not proceed until you have copied the Refresh Token.

1. Get the Token Endpoint:

   1. Search for View API Clients and select it from the results.
   2. On the View API Clients page, copy the Token Endpoint value and save it to a text file.

Note: Do not proceed until you have copied the Token Endpoint.

---

Task 3 — Create a Custom Report

SaaS Security pulls data from a custom report exposed as a web service. Complete the following steps using the Workday Security Administrator account.

1. Search for Create Custom Report and select it from the results.
2. On the Create Custom Report page:

   1. Enter a Report Name.
   2. Select Advanced from the Report Type list.
   3. Select the Enable As Web Service and Optimized for Performance checkboxes.
   4. Set Data Source to Processed Transactions for Range, System Account, Task and Business Object.
   5. Click OK.
3. On the Edit Custom Report page, select the Columns tab and add the following columns:

Business Object	Field	Column Heading Override XML Alias
Processed Transaction	Classes Updated	Classes_Updated
Processed Transaction	Instances Updated	Instances_Updated
Processed Transaction	Secured Task Executed	Task_Behavior
Processed Transaction	Entry Moment	Entry_Moment
Processed Transaction	Secured Task Executed	Secured_Task_Executed
Processed Transaction	Processed Transaction	Processed_Transaction
Processed Transaction	System Account	System_Account
Attributes that Changed	Changed Attribute	Changed_Attribute
Attributes that Changed	Previous Value	Previous_Value
Attributes that Changed	Value	Value

1. Under Group Column Headings, add the Attributes that Changed business object.
2. Select the Filters tab and add filters for the Task Behavior field. Add an Or condition for each of the following values (operator: exact match with the selection list, type: Value specified in this filter):

• Edit Tenant Setup - HCM
• Edit Tenant Setup - Global
• Edit Tenant Setup - Security
• Edit Tenant Setup - System
• Edit Tenant Setup - Reporting and Analytics
• Edit Tenant Setup - Recruiting
• Edit Tenant Setup - Payroll
• Edit Tenant Setup - Integrations

1. Select the Prompts tab:

• Select the Display Prompt Values in Subtitle checkbox.
• Add the following prompts (mark From Moment and To Moment as Required):

Field	Label For Prompt XML Alias	Required
From Moment	From_Moment	Yes
To Moment	To_Moment	Yes
Business Object	Business_Object
Task	Task
Workday Account	Workday_Account

Note: If the Business Object and Workday Account fields are not available, select Populate Undefined Prompt Defaults to add them.

1. Select the Share tab and configure the following sharing options:

Field	Value
Report Definition Sharing Options	Share with specific authorized groups and users
Authorized Groups	The security group you created for the integration system user
Authorized Users	The integration system user you created

1. On the Sort tab, do not add or modify any fields. The Sort tab must remain in its default state.
2. Click OK to save the report.
3. Get the web service URL:

   1. In the banner of the Create Custom Report page, click the ellipsis (...) next to the report name and select Web Service > View URLs.
   2. On the View URLs Web Service page, locate the JSON section.
   3. Copy the JSON URL and save it to a text file.

Note: Do not proceed until you have copied the JSON web service URL.

---

Task 4 — Connect SaaS Security to Workday

1. Log in to Cortex.
2. Select Settings > Data Sources and Integrations > Add New and click the Workday tile.
3. On the Capabilities tab, enter a name for this instance.
4. Under Default Capabilities, confirm Security Posture is selected.
5. Click Next.
6. On the Connections tab, select Log in with Credentials.
7. Enter the following values:

• Client ID
• Client Secret
• Token Endpoint
• Refresh Token
• Custom Audit Log Report Web Service URL (JSON format)

1. Click Next.
2. On the Configurations tab:

   1. Set the Sync Interval.
   2. (Optional) Add a Tag.
3. Click Next to complete onboarding.