ACAccounts in applications
Workday to Atlassian integration: managed Jira and Confluence accounts with groups per supervisory organization
With an integration between Workday and Atlassian Cloud, a new worker from Workday gets a managed Atlassian account on their start date with preferred name, employee number and location, in the groups of their supervisory organization that give access to Jira and Confluence. After the termination or contract end in Workday the account is deactivated, and their issues and pages remain.
What the integration does
Organisations that use Workday as their global HR system and run Jira and Confluence in Atlassian Cloud often have no identity provider that fills Atlassian, or one that lags behind Workday. After a reorganisation colleagues are still in the Jira groups of their old team, and contracted developers keep access after their contract ends.
- IT verifies the email domains of the companies in Atlassian and designates which supervisory organizations get a group.
- KoppelHet reads completed business processes from Workday with an Integration System User with read-only rights.
- On the hire date KoppelHet creates the account, with preferred name, business title, location and employee number, in the group of the supervisory organization.
- On a move the group membership changes on the effective date recorded in Workday.
- After the termination or contract end KoppelHet deactivates the account.
What to watch for with Workday and Atlassian Cloud (Jira en Confluence)
- Supervisory organizations in Workday regularly get a new name during reorganisations, while Atlassian cannot rename a group from provisioning. KoppelHet therefore builds the group name from the organization's reference ID. A new name in Workday then only changes the department field in the profile, not the group and therefore not the access.
- Workday distinguishes legal name and preferred name. Besides the name, Atlassian has a public name that appears in the profile and in mentions. KoppelHet sets the legal name as name and the preferred name as public name, so a colleague is called in Jira what they chose in Workday.
- A hire is often ready in Workday weeks in advance. Atlassian sends provisioned users no invitation, so nobody notices an account created early, but it does give access. KoppelHet only creates the account on the hire date, so there is no active account in advance for someone who has not started yet or does not come after all.
- Contingent workers in Workday have a contract end instead of a termination. KoppelHet deactivates their Atlassian account on that date, even if nobody formally ends the contract in Workday. A contingent worker with only an address from their own agency falls outside the verified domains and goes on a list instead of into Atlassian.
- The worker's location in Workday goes to the location field Atlassian accepts through SCIM. In an international team a colleague thus sees in Confluence that someone works in Amsterdam or Kraków, without anyone keeping it up by hand.
- Workday is not an identity provider Atlassian supports itself; Atlassian lets such a source use the user provisioning API, provided there is Atlassian Guard Standard. If Entra ID or Okta is already connected to Atlassian, that stays the source and the integration runs from Workday to that identity provider.
- On a move Workday records an effective date that can lie in the future. Atlassian has no scheduled group change. KoppelHet keeps the change and only moves the user to the group of their new organization on the effective date.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does everyone in Workday get an Atlassian account?
No. Only workers in the supervisory organizations and companies you designate. Which group gets which app you set in Atlassian.
Is the manager from Workday included?
No. The Atlassian profile has no field for the manager. The supervisory organization does determine the group, and therefore the team.
Does this also work for Bitbucket?
Accounts yes, groups not yet: according to Atlassian group sync works for Jira, Confluence and Trello, not yet for Bitbucket.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Workday is read with Get_Workers (Human_Resources) or a RaaS report on change date, with Include_Personal_Information, Include_Employment_Information and Include_Organizations, under an Integration System User with read rights on the required domains only.
- Atlassian through the User provisioning REST API (SCIM 2.0) at https://api.atlassian.com/scim/directory/{directoryId} with the directory API key. /Users with POST (409 if the user exists), PATCH and DELETE (deactivates); /Groups with POST and PATCH for members. nickName in the core schema, employeeNumber through urn:ietf:params:scim:schemas:extension:enterprise:2.0:User, basedIn through urn:ietf:params:scim:schemas:extension:atlassian:2.0:User.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in Atlassian Cloud (Jira en Confluence) | Notes |
|---|---|---|
Employee_ID of Contingent_Worker_ID | enterprise.employeeNumber | |
Werk-e-mail | userName en emails | |
Legal name | name.givenName en name.familyName | |
Preferred name | nickName (publieke naam) | |
Business_Title | title | |
Supervisory_Organization (naam) | department | |
Company | organization | |
Location | atlassian.basedIn | |
Supervisory_Organization (reference ID) | Groepslidmaatschap | |
Termination_Date of contracteinde | active = false |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included