Identity and access management
Workday to Ping Identity integration: what PingOne's Workday provisioner does, and where custom work starts
You connect Workday and Ping Identity with PingOne's Workday provisioner, which fetches new and changed workers from Workday every fifteen minutes with name, email address and status. KoppelHet adds what that provisioner does not do, such as contingent workers from Workday, department and manager as attributes and an account that is ready before the first working day.
What the integration does
Organisations that manage workers in Workday and use PingOne as their access gateway often set up PingOne's Workday provisioner. It works for permanent employees, but contractors who are contingent workers in Workday still get their access by hand, and applications lack department and manager.
- Together we review what PingOne's Workday provisioner already handles and which attributes and groups are missing.
- KoppelHet reads in Workday, with its own Integration System User, only the fields and workers the provisioner does not deliver.
- Contingent workers become users in their own population in PingOne, with the end date of their assignment.
- Department, job and manager are added as attributes on all users, and supervisory organisations become groups.
- On a termination or the end of an assignment KoppelHet disables the user on the effective date.
What to watch for with Workday and Ping Identity
- PingOne's Workday provisioner only fetches full-time employees; contingent workers are not imported. KoppelHet therefore puts contractors who are in Workday into PingOne itself, in their own population and with the end date of their assignment.
- By default the provisioner takes six attributes, including name, work email and status. Department, job or start date require an Integration System in Workday with a Field Override Service per field, and PingOne treats all those extra fields as text.
- The provisioner asks Workday for changes every fifteen minutes. If that fails, PingOne waits twelve hours and then synchronises everything again. KoppelHet alerts IT to a stalled provisioner, so a leaver does not keep access for half a day longer.
- Writing back to Workday with the provisioner is only possible for existing workers, and fails if a business process is still pending for that field. KoppelHet checks pending processes and retries the work email once the process is completed.
- The Integration System User for the provisioner must be in an unconstrained security group with read-only rights, and the policy change must be activated in Workday. KoppelHet uses its own ISU with only the domains for the extra fields, so rights can be reviewed per integration.
- A hire is often completed in Workday weeks before the start date. KoppelHet then prepares the user but disabled, and enables them on the first working day, so MFA registration and the first sign-in work on day one.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Can we not do everything with PingOne's provisioner?
For permanent employees with name, email and status, often yes. Once contractors are in Workday or applications need department and manager, KoppelHet adds to it.
Will the provisioner and KoppelHet not overwrite each other?
No. We record per attribute who fills it. The provisioner keeps its default fields, KoppelHet only writes the extra fields and the users in the contractor population.
Does this also work without the Workday provisioner?
Yes. KoppelHet then delivers all workers through PingOne's SCIM entry point, with the same rules.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Workday is read through Workday Web Services (Get_Workers in Human_Resources, also for contingent workers) or a RaaS report with an Integration System User. The PingOne provisioner uses an ISU in an Unconstrained Integration System Security Group with Get Only domains; custom fields through an Integration System with a Field Override Service (Worker business object).
- PingOne is written with a Worker app (Identity Data Admin) through the SCIM API (/v2/DirectMappedUsers for custom attributes, population.id per worker type), groups through POST /v1/environments/{envID}/groups and disabling through the enabled setting. The work email goes back through the business process for work contact information.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in Ping Identity | Notes |
|---|---|---|
Employee_ID of Contingent_Worker_ID | externalId | Fixed key |
Work email | email en username | |
Legal_Name of Preferred_Name | name.given en name.family | |
Business_Title | title | |
Supervisory_Organization | Eigen attribuut afdeling en groep | |
Manager van de supervisory organization | Eigen attribuut leidinggevende | |
Worker_Type_Reference | population.id | Employees and contractors separately |
Termination_Date of einddatum opdracht | enabled |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included