Linking your Workday account to Insightful allows seamless synchronization of employee data.
What will happen to your existing data?
Once integrated, the integration will automatically update existing employee profiles in Insightful based on Workday data. It will:
Sync employee profiles with current data from Workday.
Assign employees to the correct teams.
Deactivate employees in Insightful who are offboarded in Workday.
Before You Begin
Ensure you have Administrator permissions in your Workday system. We recommend reviewing our guide on how the integration works to ensure it aligns with your workflow.
Connect Workday to Insightful
Integrating Workday with Insightful couldn’t be simpler. First, you need to connect Workday to Insightful, and your employees will immediately start syncing.
Please note, that only the Admins can see the integrations and activate them.
To get started head to your Settings → Integrations Card → Directory Tab choose your HR provider and follow the steps required by your company’s HR software.
After you click on Configure Integration, you will be prompted to activate integration first. You will then be guided through the step-by-step screens.
Once you click on the Activate button, you will be prompted to authenticate yourself with Workday software.
The sync is completed within a couple of minutes.
... after which you will be prompted with a matching screen to review and manually match any unmatched employees.
During the synchronization process, we distribute employees to the appropriate teams within Insightful. To ensure that the right people are placed in the correct teams, the team name must be the same in both workday and Insightful.
If we do not find an existing team from Workday in Insightful, we will create a new one. The newly created team will always be labeled as ''New'' on the matching screen.
Ensure you are certain about the matched employees before clicking the Finish button, as there is no undo option after this step.
Incorrect matches can result in changes to employee details like name, email, and team. If a wrong match occurs, you will need to unmatch the employee or match them to the correct person to rectify the data, which can be a cumbersome process. To avoid the hassle, double-check matches before finalizing.
When integration is completed, you will receive a notification.
Setting Up the Integration: Linking Your Account with an Integration System User
To set up this integration, you’ll need to provide specific authentication details such as your: WSDL, ISU username, ISU password, and Workday Tenant Name.
Step 1. Create an Integration System User (ISU) in Workday
Log in to your Workday portal and access the Workday tenant.
Use the search bar to enter Create Integration System User.
Select the Create Integration System User task from the results.
4. On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password.
Due to xml encoding, "&", "<", and ">" cannot be included in the password.
Ensure Require New Password at Next Sign In is NOT checked.
You'll want to add this user to the list of System Users to make sure the password doesn't expire.
5. Click OK.
6. To prevent the password from expiring, search for the Maintain Password Rules task.
7. Add the Integration System User (ISU) to the list of System Users exempt from password expiration.
8. Enter the Integration System User name and password in the linking flow.
Step 2. Create a Security Group for the ISU
Search for Create Security Group in Workday and Select the Create Security Group task.
2. Select Integration System Security Group on the Create Security Group page from the Type of Tenanted Security Group pull-down menu.
3. Write a name in the Name field and click OK.
4. In the Integration System Users field on the Edit Integration System Security Group (Unconstrained) page, enter the same ISU name you used previously and click OK.
Step 3. Configure Domain Security Policy Permissions
1. Search for "Maintain Permissions for Security Group" in the search field.
2. Ensure the Operation is set to Maintain and the Source Security Group matches the security group assigned in Step 2.
3. On the following screen, add the applicable Domain Security Policies based on your specific use case. Set the correct permissions based on whether you are connecting Workday HRIS.
Step 4. Validate Authentication Policies
Search for Activate Pending Security Policy Changes to review the critical security.
2. Provide valuable feedback or context by adding relevant comments to the pop-up window.
3. Confirm the changes to authorize the implementation of the security policy modifications and click OK to complete the process.
Step 5. Validate the authentication policy is sufficient
Search for Manage Authentication Policies in the search field.
2. On the authentication policy row click Edit.
3. Create an Authentication Rule.
4. Enter a name, assign a Security Group, and ensure "Allowed Authentication Types" is set to "Specific User Name Password" or "Any."
If an existing Authentication Rule with "User Name Password" or "Any" exists, add the ISU created in the previous step to that rule.
If "SAML" is the only option under "Allowed Authentication Types," create a new Authentication Rule.
Step 6: Activate all pending authentication policy changes
In the search bar, type Activate All Pending Authentication Policy Changes.
On the following screen, review and confirm the changes. This will finalize the updates to the Authentication Policy.
Step 7: Obtain the Web Services Endpoint URL
In Workday, search for Public Web Services.
Select Human Resources (Public) if integrating with Workday HRIS.
Click on the three dots to open the menu, then select Web Services > View WSDL.
3. Scroll to the bottom of the page that opens (this may take a few seconds).
4. Copy the full URL provided under Human_ResourcesService (for HRIS). The URL will follow a format similar to:
5. Paste this Web Services Endpoint URL into the linking flow.
6. Click Submit.
For sandbox or implementation tenants, syncs may be slower due to limited resources.
Setting Up the Integration: Linking Your Account using OAuth
To integrate with Workday, you'll need to provide specific credentials: WSDL, Tenant Name, Client ID, Client Secret, Refresh Token, and Token Endpoint.
Ensure you have administrator privileges in your company's Workday instance to proceed with the integration setup.
Step 1. Obtain the web services endpoint URL
In Workday, search for Public Web Services.
Select Human Resources (Public) for Workday HRIS.
Click the three dots, go to Web Services > View WSDL.
4. Scroll to the bottom of the page to find the URL (this may take a few seconds to load).
5. Copy the full URL under Human_ResourcesService (for HRIS). The URL will have a format similar to:
6. Enter the Web Services Endpoint URL prefix into the linking flow, then click Next.
Step 2. Enter in your tenant name
Locate your tenant name within the web services URL (e.g., “acme”).
Input the tenant name into the linking flow.
3. Click Next.
Step 3: Register a new API Client for Integrations
In the Search field, type Register API Client for Integrations and select the task.
On the Register API Client for Integrations page, enter your Client Name and Scope (Functional Areas). Check Non-Expiring Refresh Tokens and Include Workday Owned Scope. Choose the Scope (Functional Areas) depending on the category:
3. Click Ok and save the Client Secret and Client ID. Then, click Done.
4. Enter the Client Secret and Client ID into the linking flow.
5. Click Next.
Step 4. Generate a Non-Expiring Refresh Token
In the Search field, type View API Client.
2. On the View API Clients page, go to the API Clients for Integrations tab, and save your Token Endpoint.
3. Click the client you created in Step 3: Register a new API Client for Integrations
4. Click the three dots > API Client > Manage Refresh Tokens for Integrations.
5. On the Manage Refresh Tokens for Integrations page, add a user in the Workday Account field, then save your Refresh Token.
6. Add your Token URL and Refresh Token into the linking flow.
7. Click Submit.
Sending HRIS data via SFTP
To securely transfer data between systems, we utilize SFTP. This method ensures privacy and reliability during file transmissions. Alternatively, you can opt for a one-time manual upload of CSV reports.
This guide will walk you through the process of creating a custom report in Workday, tailored to your specific needs. You'll learn how to select the relevant fields for inclusion in the report.
Step 1: Create a custom report
In your Workday tenant, search for and select Create Custom Report.
In the pop-up, fill in the following report details:
Report Name (your choice)
Report Type is Advanced
Ensure Temporary Report is unchecked
Check Enable As Web Service
Uncheck Optimized for Performance
Data Source is All Active and Terminated Workers (make sure Optimized for Performance is unchecked if this option isn’t visible)
3. Click OK.
Step 2: Adding Fields to the Custom Report
Under the Columns tab, add the fields you need by:
Selecting the Business Object for each field to include.
Selecting the Field you would like to include in the report.
If necessary for some fields, you will need to manually update the Column Heading Override XML Alias (noted in bold in the provided table).
Only a few fields are required, as indicated in the "Notes" column in the table.
Step 3: Add Group Column Headings to the Custom Report
Still under the Columns tab, scroll to the Group Column Headings section.
For included Business Objects (such as Worker, Job Family, Pay Group, or Company), add Group Column Headings as shown in the screenshot and table.
You may not need all Group Column Headings if certain fields were skipped in Step 2.
Step 4: Generate an SSH key
Search for Create x509 Private Key Pair in Workday.
In the pop-up, provide a name for the key pair for easy reference, add a description if needed, and click OK.
Workday will generate two keys. Copy the Public Key in full, including the "-----BEGIN CERTIFICATE-----" and "----END CERTIFICATE-----" lines.
Return to the linking flow and paste the Public Key in the modal. Make sure to include "-----BEGIN CERTIFICATE-----" and "----END CERTIFICATE-----".
Continue to the next page, where you’ll configure the report schedule. Do not close this page.
Step 5: Configure a schedule for your report
In Workday, search for Create EIB.
In the pop-up, choose a Name and set the field to Outbound.
Click OK.
On the Edit Outbound EIB page, select the Get Data tab.
Set the Data Source Type to Custom Report, and select the custom report created in Step 1.
Under Details, set CSV as the Alternate Output Format.
In the Transform step, set Transformation Type to None.
8. In the Deliver step, follow these details:
Delivery Method: SFTP
SFTP Address: Use the address from the linking flow, prefixed with sftp://
Directory: Refer to the Directory from the linking flow
Authentication Method: SSH Authentication
User ID: User ID from the linking flow
SSH Authentication Key Pair: Choose the Key Pair created in Step 4
File Name: Employee Information.csv
9. Proceed to Summary to review entries. Once confirmed, select OK.
10. Go back to the linking flow in your browser and click Next. After a brief loading, a success message will appear.
11. In Workday, navigate to the Integration System screen, select the three dots, then Integration > Launch/Schedule.
12. In the schedule configuration screen, set up a daily recurrence or your preferred schedule, then select OK.
13. If choosing a daily recurrence, leave default settings on the Schedule Integration screen, adjusting only the fields in the Schedule tab.
Step 6: Connection complete!
Click Finish in the linking flow to finalize the connection.
Once connected, we’ll verify the report formatting, syncing data as per the scheduled configuration.
File size limit is 250MB. Contact support if you need a higher limit.
Troubleshooting
If you are having difficulties sending or receiving the data please first check the following common requirements.
Populate the Workday EIB User ID with the latest ID from the linking flow.
Make sure you have included the following required fields
employee_id
manager_id (if you need manager data))
postion_id (reported for employment data)
Your report name needs to be exactly Employee Information.csv
Your report needs to be in .csv format
Your Workday public key needs to include "-----BEGIN CERTIFICATE-----" and "----END CERTIFICATE-----"
Important Notes
Employee ID and Manager ID
For Workday instances where Worker Workday ID and Manager ID formats vary, use Worker's Manager as the Business Object and Workday ID as the Field. Rename Column Heading Override XML Alias to manager_id.
Worker Status and Deleted Employees
It’s recommended to include the Worker Status field to track employee activity status.
If a previously included employee is missing in a future sync, we’ll mark them as deleted.
Terminated employees will also be marked as such.
Deleted employees are not automatically considered terminated.
Filtering Data
The above configuration sends all employees via the generated file. To send only a specific subset, configure a Filter in the Custom Report between Steps 2 and 3.
An example filter has been included below:
Enabling TimeOff Data for Workday
This article is intended for Merge customers setting up access to Workday’s Time Off endpoints. While most data requests to Workday use SOAP requests, obtaining full Time Off data requires Workday's REST API, which uses OAuth credentials. Once the feature is enabled, customers can follow the Accessing Time Off Data From Workday guide to correctly link their Workday accounts with Time Off permissions.
Completing the Integration
Once the integration is activated, Insightful will sync employee data from Workday. The synchronization takes just a few minutes, after which you will be prompted to review and manually match any unmatched employees. Be careful during this step, as incorrect matches may require a cumbersome manual correction.
Post-Integration Adjustments
Edit Matched Employees
You can update employee matches at any time through the "Match Employee" button in the integration overview.
Deactivation
If you deactivate the integration, synced data will remain, but no new data will be imported until you reactivate it.
Important Notes:
Ensure your Workday and Insightful team names match for proper team assignments.
Double-check all employee matches before finalizing, as incorrect matches may alter employee data and require manual fixes.
What fields do we sync from Workday?
Employee's first name
Employee's last name
Employee's work email
Employee's job title
Employee's department
Employee's employment status - if they are active or not active employees
In the top right corner, the team name displayed as “Executive Management” is directly sourced from Workday. The name of the person's team is taken from the Supervisory type field in the Workday.
We use “Supervisory” group type for determining the team name.
On the left, the name and title shown are pulled from the employee's First and Last name, along with their Job Title, as recorded in Workday.
We retrieve the email address from this section, ensuring that only the designated "work" email is selected and used.