> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/hris/workday.md). # Workday Workday is an ERP (enterprise resource management) system that provides a unified SaaS solution for finance, human capital management, and business intelligence. With over 60 million users and 9,500 globally recognized customer organizations, Workday provides a single platform for recruiters to manage all facets of the hiring workflow, from sourcing candidates to assessing applications and holding interviews. DoControl leverages data collected by Workday to expedite decision making. Captured data is actor metadata, such as user employment status, groups and departments that users belong to, and other relevant metadata such as title or personal email, or the name and email of the employee's manager. After setting up the integration, DoControl captures data from employee records to calculate specific groups that can be leveraged in workflows. These [groups](/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md#default-hr-groups) include: * About-to-leave employees * Current employee personal emails * Former employee personal emails * Former employee work emails {% hint style="success" %} In Workday, you need to create an integration system user (ISU) so your DoControl user is logged in as one user. This also allows you to limit permissions to DoControl. {% endhint %} ## Use cases You can leverage the DoControl-Workday integration to address these use cases: * **Get full inventory visibility** - View all Workday users, departments and [HR groups](/docontrol-user-guide/saas-data-monitoring/inventory/settings-groups.md#default-hr-groups), including terminated and about-to-leave employees. In a single glance, view your organizational posture to see: how many Google assets are accessible by former employees? How many employees share with their personal emails? * **Trigger alerts** - You can get real-time notifications when anomalous behavior occurs, such as when an about-to-leave employee performs a burst download of files and sends them to his personal email account. To see all DoControl alert types that leverage HR metadata from Workday, go to **Help > DoControl Alert Specifications**: * Possible former employee accessed assets (DC30) * File download by about-to-leave employee (DC33) * Possible former employee publicly shared (DC34) * Possible former employee externally shared (DC35) * Burst download by about-to-leave employee (DC36)
* **Remediate future data exposure** - Define security workflows to handle a specific department in your organization, and prevent about-to-leave employees from downloading or externally sharing documents. * **Get user metadata** - You can run a query to get user metadata for specific events. For example, if an employee in your organization changes user access for a Google Drive asset so it's now publicly shared, you can choose to remove the public sharing if the employee fulfills certain criteria. * **Monitor risky identities** - Discover your internal SaaS identities to protect your organization from identity threats in Google Workspace. ## HRIS fields for integration The default fields DoControl extracts for the HRIS integration include: * **Users** - User’s avatar (picture), Work email, First name, Last name, Role, Department, Manager (full name), Manager (email), Employment status, Personal home email address, Job location, End employment date, Hire date. * **Departments** - Department name and ID {% hint style="info" %} If you use customized fields, please reach out to Customer Success to assist with mapping these fields. {% endhint %} ## Integrate Workday with DoControl To integrate Workday with DoControl for the first time, perform these steps: 1. [Create a security group in Workday](#create-security-group-in-workday) 2. [Create an integration system user (ISU) in Workday](#create-integration-system-user-isu-in-workday) 3. [Run the DoControl integration wizard](#run-docontrol-integration-wizard) {% hint style="warning" %} You must be an **admin** user to integrate Workday with DoControl. {% endhint %} ### Create security group in Workday When you create a dedicated security group in Workday, make sure to assign the required permissions. 1. In Workday, navigate to the **Create Security Group** task and create an Integration System Security Group. 2. Grant permissions to your newly created security group. For each domain you want to grant access to: * Navigate to the **View Domain** report and find the domains listed below. * Click **Domain > Edit Security Policy Permissions**. * Add the security group you just created, and grant permissions for GET. {% hint style="warning" %} To integrate Workday with DoControl, you need to grant permission to these domains: {% endhint %}
Data typeRequired domainDoControl fields from Workday
Person dataName
  • First name
  • Last name
  • Middle name
Person dataHome contact informationPersonal email address
Person dataWork contact information
  • Primary work email
  • Work email
  • Public work email address integration
  • Job location
  • Manager email
Worker dataWorkersList of all employees
Worker dataAll positionsUsed to build manager object
Worker dataCurrent staffing informationCurrent position and role
Worker dataPublic worker reportsAccess the service and pull the info about employees
Worker dataEmployment data
  • Employment status
  • Hire date
  • End date
Worker dataOrganization informationHigh-level hierarchy of the company
Get organizationsList of departments
3. Activate these permissions by navigating to the **Activate Pending Security Policy Changes** task. ### Create integration system user (ISU) in Workday Make sure you created a [security group in Workday](#create-security-group-in-workday) before you create the integration system user. 1. In Workday, navigate to the **Create Integration System User** task and configure a Workday user for DoControl. 2. Set the **Session Timeout Minutes** to 0 to prevent session expiration. 3. Navigate to the **Maintain Password Rules** task and add the integration system user (ISU) to the System Users exempt from a password expiration. 4. Optionally, enable the **Do Not Allow UI Sessions** checkbox to block the integration system user from logging in via Workday. 5. Link the Security Group to the integration system user by selecting **Security Profile > Assign Integration System Security Groups**. 6. Select the security group you previously created. Navigate to the **View Integration System** report and access the Connector or Studio integration. 7. Click **Workday Account > Edit** and select the integration system user. ### Run DoControl integration wizard After you've created a [security group](#create-security-group-in-workday) and [integration system user](#create-integration-system-user-isu-in-workday) in Workday, you're ready to run the DoControl integration wizard.
1. From the DoControl side menu, click **Integrations**. 2. Under the HRIS icon, click **Connect**. 3. From the HRIS integration wizard, select **Workday**.\ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FRJ2VWTy3B6HhcvHDG02y%2FWorkday%20wizard.png?alt=media\&token=06112f6b-19f8-4528-bafc-21d53b7692b2) 4. Enter the **user name** of your Workday integration system user (ISU) that you [already created](#create-integration-system-user-isu-in-workday). 5. Enter the **password** of your Workday integration system user (ISU) that you [already created](#create-integration-system-user-isu-in-workday). 6. Enter the **tenant ID**. The Tenant ID is found in the URL when you are logged into Workday. For example: \ URL of Workday tenant: Tenant ID: sample\_company 7. Enter the **WSDL URL**. The Workday WSDL URL is the base URL for every API request. Find your WSDL URL [here](https://community.workday.com/articles/6120#endpoint). If you are unsure, use . 8. Click **Save**. Workday is now integrated with DoControl. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/integrations/hris/workday.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.