OIIdentity and access management
Workday to One Identity integration: employees and organisation from Workday in One Identity Manager
One Identity Manager reads Workday through the Starling Connect connector Workday HR, which puts employees in the Person table and creates departments, cost centres and locations as separate objects. With an integration between Workday and One Identity, that data drives the accounts and rights One Identity manages in Active Directory and other systems; KoppelHet sets up the connector and catches what it skips.
What the integration does
Organisations that use Workday as their HR system and One Identity Manager for accounts and rights often still read Workday through a nightly file. Departments, divisions and teams then arrive mixed up, new colleagues only appear on their first working day, and the new email address is retyped in Workday.
- In Workday we create an integration user with the rights One Identity describes for the Workday connector.
- In Starling Connect we set up the Workday HR connector with tenant, API version and that user.
- In One Identity Manager we create a synchronisation project on the Workday HR template, with mappings to Person, Department, ProfitCenter and Locality.
- KoppelHet sets the rules that tell departments, divisions and other organisation types from Workday apart.
- New employees arrive before their start date; email and phone go back to Workday once the account is created.
Back: One Identity writes the business email address and phone numbers back to the worker in Workday.
What to watch for with Workday and One Identity
- For Workday One Identity provides a fixed template, One Identity Starling Connect Workday HR, as part of the module for cloud HR systems. It runs through Starling Connect, which offers Workday as a SCIM source. KoppelHet therefore builds no reader of its own, but sets up that template.
- Workday has many kinds of organisations, such as department, division and team. Starling Connect returns them all through one source, CustomOrgs, with a Type attribute. Without a filter on that type every team becomes a department in One Identity; KoppelHet fixes per type whether it becomes a department, cost centre or nothing.
- Since version 6.0 of the Workday HR connector Starling Connect leaves inactive employees out of the lists of employees, future employees and deltas. A leaver therefore disappears from the source instead of getting an end date. KoppelHet sets One Identity to block a Person that has disappeared, not delete it straight away.
- The connector has a separate list for employees with a start date in the future. KoppelHet includes it in the synchronisation, so One Identity prepares the account and rights before the first working day instead of on the day itself.
- Writing back to Workday is only possible for three Person fields - phone, mobile and the default email address - and One Identity advises against adding more two-way rules. The email address One Identity creates thus reaches Workday without HR retyping it.
- Starling Connect signs in to Workday with a username and password for the tenant. KoppelHet gives that user in Workday only the rights the connector needs, plus the right to update contact details for the write-back.
- The module for cloud HR systems requires One Identity Manager 8.1.5 or later. On an older version we read Workday through a RaaS report and One Identity's CSV connector until the upgrade is done.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do we need Starling Connect?
For the standard template, yes; the Workday connector runs there. If you do not have it, it can go through a RaaS report and the CSV connector, with fewer options.
What happens when someone leaves?
The employee drops out of the source. One Identity then blocks the Person and the accounts, according to the rules we set at the start.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Starling Connect Workday HR connector: endpoints Employees, FutureDatedEmployees, DeltaSyncEmployees, Locations and CustomOrgs (Workday Organizations, with attribute Type). Operations Get and Get All, plus Update Employee (PUT) for the write-back. Connection with connector name, tenant, API version, username and password. From connector version 6.0 without inactive employees.
- One Identity Manager: template One Identity Starling Connect Workday HR in the Cloud HR Systems module (from 8.1.5), through the SCIM connector. Mapping Employees to Person, CustomOrgs to Department and ProfitCenter, Locations to Locality. Write-back only Phone, PhoneMobile and DefaultEmailAddress.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in One Identity | Notes |
|---|---|---|
Workers (Employees) | Person | |
Organizations van type afdeling | Department | Through the Type attribute of CustomOrgs |
Organizations van type kostenplaats | ProfitCenter | |
Locations | Locality | |
Toekomstige medewerkers (FutureDatedEmployees) | Person vóór de startdatum | |
Primair zakelijk e-mailadres | DefaultEmailAddress | Return from One Identity to Workday |
Telefoon en mobiel | Phone, PhoneMobile | Return from One Identity to Workday |
- One Identity Manager 9.0 LTS – Administration Guide for Connecting to Cloud HR Systems
- One Identity Manager 8.1.5 – Administration Guide for Connecting to Cloud HR Systems
- Starling Connect Hosted – One Identity Manager Administration Guide
- One Identity Manager 9.3 – Starling Connect Connector Module Release Notes
- One Identity Manager 9.3 – CSV Connector User Guide
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included