Workday to Saviynt integration: Workday as the identity source in Saviynt, with Saviynt's connector

What the integration does

Organisations that use Workday as their HR system and Saviynt for identity governance have the Workday source set up during the Saviynt project. Afterwards it turns out that new employees only get an identity on their first day, that a departure sometimes only comes through at the next full import, and that the email address from Saviynt is not in Workday.

1. In Workday we create an Integration System User with its own security group and only the rights the connector needs.
2. In Saviynt we set up the Workday connector, with the employee number as username.
3. For new workers with a future start date we set up a separate report or filter, so the identity exists before day one.
4. Alongside the incremental import we schedule a full import, so changes and departures are picked up as well.
5. The email address Saviynt creates is written back to Workday by the connector.

What to watch for with Workday and Saviynt

• Saviynt builds and maintains the Workday connector itself, under its own support and maintenance agreement. According to Saviynt all Workday integrations run through Workday's web services API; KoppelHet therefore builds no import of its own, but sets up that connector.
• The connector does more than import. Saviynt also lists creating, changing, enabling and disabling accounts in Workday and adding or removing access. Using that lets Saviynt manage the Workday permissions themselves too; KoppelHet keeps that role out of scope at the start and lists it as an extension.
• Saviynt advises putting the unique HR identifier on the username attribute. KoppelHet uses the Workday Employee_ID for that, and their own ID for contingent workers, so a move from external to internal does not create a second identity.
• According to answers on the Saviynt forum, an incremental import on a Workday report only brings in new users. KoppelHet therefore also schedules a full import, so a job change or departure does not wait until someone starts it by hand.
• Workday stores a hire with an effective date, and a standard report often only shows who is employed today. For workers starting in two weeks KoppelHet uses a report or filter on future effective dates, so their account is ready on the first day.
• Saviynt describes in its knowledge base how a generated email address goes back to Workday. KoppelHet sets up that return path, so the work address in Workday matches the account, and gives the integration user in Workday write access only to work contact information.
• From version 23.12 the connector supports OAuth for import and provisioning according to the Saviynt forum, alongside basic authentication. KoppelHet chooses OAuth with a refresh token, so a password policy in Workday does not stop the import.

This integration is also part of joiner, mover, leaver.

How we build and run it

• The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
• Every sync and every error is visible in the functional log; on an error your administrator is notified.
• A change that cannot go through is not half-applied but queued for another attempt.
• KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
• After go-live we manage the integration and adjust it when your process changes.
• The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.

Implementation, architecture and compliance

Implementation and price

This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.

A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.

Frequently asked questions

Related

• Identity and access management
• Workday integrations
• Saviynt integrations

→

Ashby → Workday

Ashby to Workday integration: hires to Workday, with a check on outcome and phone number

→

Bullhorn → Workday

Bullhorn to Workday integration: a consultant's first placement as a hire in Workday

→

Carerix → Workday

Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire

→

Greenhouse → Workday

Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included