Identity and access management
Workday to JumpCloud integration: accounts in JumpCloud from a Workday report
With an integration between Workday and JumpCloud, JumpCloud reads a Workday report as JSON and creates, updates and suspends accounts based on the status in Workday. KoppelHet sets up the report, the integration user and the mapping, and monitors the last successful import.
What the integration does
Organisations that have Workday as their HR system and JumpCloud as the directory for accounts, SSO and devices often create accounts by hand. For JumpCloud to read from Workday, a report, an integration user and permissions have to be set up in Workday.
- In Workday we create an Integration System User without UI sessions and put it on the system users list.
- We create a security group with Get-only rights on the domains JumpCloud lists, and activate the policy change.
- We build an Advanced report as a web service with the fields for JumpCloud and share it with the integration user.
- In JumpCloud we point the Custom API import at the report's JSON URL, with the mapping and the status rule.
- KoppelHet checks with Preview Mapping and then monitors whether new employees get an account in time.
What to watch for with Workday and JumpCloud
- JumpCloud does not read a Workday API directly, but an Advanced report published as a web service. Which workers and fields JumpCloud sees is therefore decided by that report's definition; KoppelHet records it in the handover.
- JumpCloud only reads JSON, with Report_Entry as the location of the records and basic authentication with the integration user in the header. That user's password may not contain &, < or >, because Workday processes it as XML.
- Workday expires an integration user's password unless the user is on the system users list. If it is not, the import stops after expiry without anyone noticing; KoppelHet puts it on the list and monitors the last successful import.
- Leavers work through a status rule. JumpCloud recommends an expression that suspends a user when Active_Status in the report is 0; the user is therefore suspended, not deleted, and their devices and groups remain visible to IT.
- According to JumpCloud, putting Workday fields into JumpCloud custom attributes is not supported yet. Fields such as manager or location that do not fit the standard attributes therefore do not come across; at the start KoppelHet determines which group rules rely on them and what has to change.
- For SSO JumpCloud sends a NameID that must match the Workday username. If that differs from the email address, every user gets an extra WorkdayID attribute; KoppelHet fills it during setup, so signing in to Workday through JumpCloud keeps working.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is a leaver deleted from JumpCloud?
No, with the recommended status rule they are suspended. Deleting remains a deliberate step by IT.
Which JumpCloud package is needed?
According to JumpCloud at least the SSO Package.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Workday: Integration System User (Do Not Allow UI Sessions, on the System Users list), Integration System Security Group (Unconstrained) with Get Only on Person Data (Name, Personal Data, Work Contact Information), Worker Data (Workers, All Positions, Current Staffing Information, Public Worker Reports, Employment Data, Organization Information) and Manage: Location among others; Advanced report with Enable as Web Service, JSON URL through Actions > Web Service > View URLs.
- JumpCloud: Custom API import with API Key authentication (Authorization header with Basic and base64 of username and password), Base URL the Workday JSON URL, Resource Location Report_Entry, endpoint /<reportName>?format=json, pagination as chosen; Unique ID id, state through an EXPR on Active_Status. Requires the SSO Package or higher.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in JumpCloud | Notes |
|---|---|---|
Workday ID (alias id) | Unique ID van de import | Key between both systems |
Work email | email en userName | |
Employee ID | employeeIdentifier | |
Business title | title | |
Supervisory organization | department | |
Company | organization | |
Cost center | costCenter | |
Worker type | userType | |
Active_Status | state | 0 means suspended |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included