Workday Integration - User Provisioning Integration Configuration

Introduction

This document provides a step-by-step guide on how to set up a user provisioning integration from Workday to Reward Gateway | Edenred, to keep an automatic sync of joiners, movers, and leavers. This integration is currently available in Australia, United Kingdom, and United States only.

The configuration includes two parts:

1. Workday Tenant Setup – giving the necessary permissions and obtaining authentication credentials for the integration.

2. Reward Manager Setup – authenticating the integration on Reward Gateway’s side and configuring the employee fields which should be synced.

Index

Workday Tenant Setup

Creating the ISU

Creating an Integration System Security Group

Adding the ISU to the ISSG and Applying Changes

Creating an API Client for Integrations

Reward Manager Setup

Authorization

Data Mapping

Reviewing and Publishing

Appendix 1: Workday Integration System Setup

Creating an Integration Field Override Service

Creating an Integration System

Mapping Calculated Fields in Reward Manager

Appendix 2: Filtering Members via Security Group

Appendix 3: Filtering Members via Integration System

Workday Tenant Setup

Follow along with the guide to create the required API Client for Integrations in your Workday tenant.

Creating the ISU

1. Log into Workday:
Navigate to your Workday login page and enter your credentials
2. Search for Create Integration System User and select the task from the search results

3. Fill Out User Information:
Enter a unique username for the ISU account and set a password.
Leave the rest of the fields as shown in the screenshot below.

4. Click the OK button to create the ISU account

Note: The Do Not Allow UI Sessions option can be enabled for an added layer of security.

Creating an Integration System Security Group

1. From the Workday search bar, type Create Security Group and select the highlighted task

2. Select Security Group Type Integration System Security Group (Unconstrained) and enter a Name

3. In the Workday search bar, type Maintain Permissions for Security Group and select the task.


4. Find your security group, select it and click OK:

5. Find and apply the permissions from the screenshot:


You can add new permission rows by clicking on the + icon on the top left corner of the table.

Note: You can add additional permissions depending on the fields you want to use.

Note: If you want to filter the workers your Workday integration has access to please refer to Appendix 2

Adding the ISU to the ISSG and Applying Changes

1. In the Workday search bar, type View Security Group and select the report.  

2. Find and select your security group, then click OK.


3. Click the Edit option in the three-dot menu next to your ISSG’s name

4. In the Integration System Users field type your ISU’s name and select it, then click OK

5. In the Workday search bar, type Activate Pending Security Policy Changes and select the task

6. Apply the changes by checking the Confirm checkbox and clicking OK

Creating an API Client for Integrations

1. In the Workday search bar, type Register API Client for Integrations and select the task

2. Enter a name for your client and include the listed scopes. Make sure to enable Non-expiring refresh tokens. Include the following scopes:

• Staffing
• Contact Information
• Performance Enablement
• Personal Data
• Worker Profile and Skills

3. After clicking OK, you’ll see the new Client’s details. Save the Client ID and Client Secret as you’ll need them later.

Client Secret will not be shown again after clicking Done on this window. We can regenerate a new one from Client's actions.

4. From the same submenu in the screen above, we select Manage Refresh Tokens for Integration. In the new window select your ISU and click OK

5. On the next page, select the Generate New Refresh Token option and click OK

6. Save the newly generated refresh token for later use

Reward Manager Setup

Return to Reward Manager and navigate to your Workday integration. If you haven’t created one yet, do so from the Integrations Dashboard.

Creating the Integration:

1. Log into Reward Gateway | Edenred’s Reward Manager
2. Navigate to Integrations > Integrations Dashboard
3. Click on the Workday tile under Provisioning to create a new integration

Authorization

Provided you have configured a Workday API Client for integrations as described in Workday API Client Configuration, you will need to provide the following information:

• Client ID
• Client Secret
• Refresh Token
• Tenant Host
• Tenant Name

To make sure you are using the correct Tenant Host and Name, you can log into your Workday account and run the View API Clients task. The top of the page will look something like this:

You will need parts of the URL specified as Workday REST API Endpoint, where the domain name is the Tenant Host and the last part is the Tenant Name.

On this screenshot:

• Tenant Host is: https://impl-services1.wd12.myworkday.com
• Tenant Name is: rewardgateway_dpt1

Next, review the rest of the setup options:

1. Select the frequency of data imports
2. Tick the Automatically dispatch welcome emails? box if you want new members provisioned through the integration to get a welcome email.
3. Integration System Workday ID - this is an optional field that is used to get calculated fields in the mapping options. Please view Appendix 1: Workday Integration System Setup if you want to use that feature.

Data Mapping

The next step is mapping the Workday fields. Select which Workday worker data corresponds to each employee field listed.

Note: If you wish to use the Workday Recognition Sharing integration, you should map the field Workday ID as well. It has a 32-characters long HEX value (0-9a-f). You can check the example data upon selecting the field from the dropdown to verify.

You can press Save and proceed to the Review and Publish step for a summary.


Reviewing and Publishing

Review your setup and example record. Once you are sure the integration is set up correctly, press Complete to publish it.

That’s it! Your new integration is ready. Your employees' data will be automatically synced depending on the interval you’ve selected in the Authorize step.

Appendix 1: Workday Integration System Setup

Integration System is used when you need to use calculated fields in your integration. Follow these steps to create one.

Creating an Integration Field Override Service

1. Type Create Integration Field Override Service in the search bar and click on the task

2. Give it a name and select the Worker Business Object 

3. Add a field for each calculated field you want to use by clicking the + icon

Creating an Integration System

1. Type Create Integration System in the search bar and click on the task

2. Give the Integration System a meaningful name and choose the Core Connector: Worker Template

3. Click OK to continue.  
4. Click on the three dots next to the name of your Integration System and select
Integration System → Configure Integration Attributes

5. Fill in all required fields to finish creating the Integration System and click OK to continue
6. From the same menu in step 4, select Integration System → Configure Integration Services

7. Scroll down to Custom Integration Services, click the + icon and select the Fields Override Service we created earlier

8. Click OK to continue
9. From the Integration System menu, select Integration System → Configure Integration Field Overrides

10. From the menu on the left, select the Fields Override Service. Assign your calculated fields to the Override External Field.


11. Click OK to save changes.  
12. From the Integration System’s menu, select Workday Account → Edit

13. Search for the ISU and select it. Then, click OK.

14. From the Integration System’s menu, select Integration Field Override → Test Security. Click OK on the next window.

15. In the next window, ensure that ISU has access to all for the configured custom fields

If any of the fields has a value of No in the Accessible by User column, look up that fields security and add the relevant scopes to the ISSG

16. Finally, we need to get the Workday ID of the Integration System. From the Integration System menu, select Integration IDs → View IDs option:

Mapping Calculated Fields in Reward Manager

Now that you’ve added the Integration System to your integration, you should be able to see calculated fields on the Mapping step. They can be found under the Integration Field Overrides tag.

Once you select one of the fields, you should see example values.

Appendix 2: Filtering Members via Security Group

You can restrict which members your Workday integration has access to by creating a Constrained Integration Security Group. To do so, follow the above guide up to Workday User Provisioning Integration Configuration|Create an Integration Security Group, and then follow the below steps:  

1. Select Integration System Security Group (Constrained) for the type field in the Create Security Group task

2. Give your Security Group a name and click OK.
3. On the next page, add your ISU 
4. In the Organizations field, add all the organizations you want to allow the Workday integration to have access to

5. On the right-hand side of the window, select if the restriction applies to current organizations only or current organizations and all subordinates
6. Click OK to finish setting up the Security Group

From this point on, you can return to step 3 of Workday User Provisioning Integration Configuration|Create an Integration Security Group, and continue your setup as described in the guide.

Appendix 3: Filtering Members via Integration System

You can restrict which members your Workday integration has access to using an Integration System and it’s Eligibility Criterion. The eligibility criterion allows you to filter members based on a calculated field that returns a boolean value.

Note: If you don’t have an Integration System, learn how to create one here: Create an Integration System.

1. Create a calculated field with a True/False condition (skip to step 5 if you have an existing field that satisfies your filtering needs)

2. Select an appropriate Field Name, Business Object (usually Worker) and the True/False Condition Function  
3. Set up your filtering condition. In this example, we are filtering members based on their cost center’s name.

4. Find your Integration System and, from it’s menu, select Integration System → Configure Integration Field Overrides

5. Add your calculated field to the Integration System’s eligibility criterion

6. Click OK to save your changes
7. Open the Integration System’s menu and navigate to Integration System → View Integration Field Overrides

8. From the Eligibility Criterion’s menu, select Integration IDs → View IDs

9. Save the Workday ID to use in your Workday Integration’s setup