BiAccounts in applications
Workday to Bitwarden integration: members per organisation, revoked on leave and termination
With an integration between Workday and Bitwarden, every worker from Workday receives an invitation to the Bitwarden organisation on their start date, in the group of their supervisory organization, and is revoked on a Termination or long leave. A revoked member does not take up a licence seat and gets their access back on return without a new invitation.
What the integration does
Anyone running HR in Workday and using Bitwarden for shared passwords per team often adds members to Bitwarden by hand, especially when Entra ID is not set up the same everywhere. Workers on parental leave or a sabbatical thus keep access for months to collections they no longer work on.
- HR completes a Hire in Workday, often weeks before the start.
- On the start date, once the work email is in Workday, KoppelHet invites the worker to Bitwarden, in the group of their supervisory organization.
- The worker accepts and an administrator confirms them; after that they see their group's collections.
- On a Change Job to another organisation the member moves to the new group.
- On long leave or a Termination KoppelHet revokes the member on the effective date; on Return from Leave KoppelHet restores access.
What to watch for with Workday and Bitwarden
- A Hire is often completed in Workday weeks before the start date, but a Bitwarden invitation needs a work email that does not exist yet. KoppelHet only invites on the start date and only once the work email is in Workday.
- Workday has leave as its own business process, with a start date and an expected end date. For the leave types you choose KoppelHet revokes the member, and Return from Leave restores them. According to Bitwarden a restored member does not need to be invited or confirmed again.
- A revoked member does not take up a licence seat in Bitwarden. Workers on months of leave therefore cost no licence, while their own vault is kept.
- Each supervisory organization becomes a Bitwarden group with the Workday ID as external ID. If HR renames an organisation, the group keeps its collections, because KoppelHet searches on the ID and not on the name.
- Contingent workers have their own number range and a contract end date in Workday. They go into a separate group with only their project's collections, and are revoked on their contract end date, even if nobody submits a Termination.
- A Termination with a future effective date only revokes the member after that last working day, in the time zone of the Workday location. A worker in Singapore therefore does not lose access half a day too early or too late.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not through Entra ID or Okta?
If all your workers are in one Entra ID or Okta, Bitwarden's SCIM integration from there is usually simpler. This integration is for organisations where Workday is the only place that knows all countries, leave and contingent workers.
Can the integration also confirm the member?
No. After acceptance an administrator confirms the member in Bitwarden; that is how the keys for shared collections are exchanged. KoppelHet reports which members are still waiting for confirmation.
Which Bitwarden plan is needed?
The Public API is available to Teams and Enterprise organisations. With another plan this integration is not possible.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- KoppelHet reads Workday through a RaaS report with a read-only Integration System User, on completed business processes Hire, Change Job, Leave of Absence, Return from Leave and Termination, with effective dates and location.
- Bitwarden is written through the Bitwarden Public API (api.bitwarden.com or api.bitwarden.eu) with the organisation API key (client_id organization.ClientId, grant_type client_credentials, scope api.organization; token 3600 seconds). Members and groups with externalId; revoke and restore through the member endpoints from release 2026.2. Lists with continuationToken. The Public API does not manage vault items.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in Bitwarden | Notes |
|---|---|---|
Employee_ID of Contingent_Worker_ID | externalId van het lid | With a prefix per number range |
Werk-e-mail | email | |
Supervisory_Organization (ID en naam) | Groep: externalId en name | |
Worker type (employee of contingent) | Groep voor ingehuurde krachten | |
Leave of Absence (type en datums) | Lid intrekken en herstellen | |
Termination (laatste werkdag) | Lid intrekken; verwijderen na een afgesproken termijn | |
Vaste waarde | type User | Admin roles remain manual work in Bitwarden |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included