Workday Connector Integration

Integrate Workday as a Connector in Axiad Mesh to get user data necessary to fill out your environment and for Axiad to find correlations, risks, and gaps in your population.

To set up Workday as a connector, you must configure Workday for API access and then add it as a connector in the Mesh administrative portal.

Workday Configuration Steps

IMPORTANT

These steps are Axiad’s current understanding of the configuration. Since Workday is a third-party product, there may be slight variations between your experience and what the guide describes. We work hard to keep things as up to date as possible, but depending on versions in use, latest updates, etc., there may be some mismatches.

If you find any blatant differences or anything that does not make sense, then please provide feedback on this article.

To configure Workday for API access, complete the following steps, and then you can add Workday as a connector in Axiad Mesh.

Create Integration Systems User and Group

1. In Workday, create an Integration Systems User (ISU), setting up the credentials

2. Next, create an Integration Systems Security Group (Unconstrained)

3. Bind the newly created ISU to the new Security Group

4. Add Domain Security Policies to the Integration Systems Security Group as follows:

   • Domain Security Policies permitting View access add View: Supervisory Organization

   • Domain Security Policies permitting Get access add:

     • Manage: Location

     • Manage: Organization Integration

     • Worker Data: Current Staffing Information

     • Worker Data: Public Worker Reports

Create an API Client

1. In Workday, locate the Register API Client for Integration task

IMPORTANT

Be sure to select Register for API Client for Integration rather than just Register API Client as Axiad Mesh requires the former as it leverages OAuth 2.0 Client Credentials grant flow

2. Set the Client Name to a friendly name that is meaningful to the integration

3. Set the Client Grant Type to Authorization Code Grant

4. Check the Support Proof Key for Code Exchange (PKCE) option

5. Set the Access Token Type to Bearer

6. Set the Redirect URI to a syntactically valid URL (value not required for the integration, but must be set for the client configuration)

7. Set the Refresh Token Timeout to your preferred amount of days

8. Check the Grant Administrative Consent option

9. Select the scopes that this API client can access

   • Required Scopes:

     • Organization and Roles

     • System

10. Check the Include Workday Owned Scope option

11. Complete the creation and then copy the Client ID and Client Secret values (required for the Axiad Mesh configuration steps)

Generate a Refresh Token for the API Client

1. In Workday, locate the View API Clients report

2. In the API Clients for Integrations tab, locate your newly created API client

3. Click on the three-dot menu button next to the client’s name, hover on API Client and then click Manage Refresh Tokens for Integrations

4. Add the ISU account that you created in step 1 to the Workday Account field

5. Click OK to generate the refresh token

6. Copy the refresh token to use in the Axiad Mesh configuration steps

Axiad Mesh Configuration Steps

You can add Workday as a connector easily from the Mesh administrative portal.

1. From the homepage, click on the gear icon menu button to get to the Settings page

2. On the Connectors page, click the Add connector button, either in the middle of the page if this is your first connector, or in the top right side of the screen

3. In the new pop-up, set the Name to a friendly name that will appear on the Connectors page

4. Select Workday from the Provider dropdown

5. Set the Workday tenant to the Workday Organization ID

Retrieve your Workday Organization ID

The Organization ID can be found in the URL of your Workday console or by clicking on the user icon in the top right > My Account and selecting Organization ID. Copy that value and paste it into the Workday tenant field.

6. Set the Workday API client_id and Workday API client_secret fields to the values that you received from Workday in Create an API Client step 11 above

7. Set the Workday API refresh_token to the value copied from Generate a Refresh Token step 6 above

8. Click the Test connection button once all values are provided

9. Following a successful test, click Add & connect to complete the configuration

10. Now your Workday connector will appear on the Connectors page