Before You Start

Please ensure that you have Administrator privileges in Workday before continuing with the instructions below.

Overview: What You’ll Need

Please set aside 20 minutes to complete this one-time setup process. We’ll walk you through 8 steps to collect a set of required values from Workday.

1. Retrieve your Workday Tenant ID

2. Create an Integration System User

3. Configure a Security Group

4. Configure the Domain Security Policy Permissions for the Security Group

5. Activate the Security Policy Changes

6. Configure the Authentication Policy

7. Activate the Authentication Policy Changes

8. Retrieve your Web Services Endpoint URL

Step 1: Retrieve the Workday Tenant ID

1. Log into your Workday account

2. Retrieve your Tenant ID from the URL of your web browser

   • If the URL looks like *<https://impl.workday.com/somecompany*> then your tenant ID is somecompany

   • If the URL looks like *<https://somecompany.workday.com>* then your tenant ID is somecompany

• Paste your Tenant ID into Finch Connect

Step 2: Create an Integration System User

1. In the search bar at the top of the page, search for “Create Integration System User” and click on the resulting task.

   

2. Fill in the following information to create an account:

   1. User Name: Use the first 3 letters of your company name followed by “Support” (Example: ABCD Company → ABCSupport)

      1. Copy this value into Finch Connect

   2. New Password: Create a password that meets the security requirements. Make sure the password does not contain any of the following characters: &, ", >

      1. Copy this value into Finch Connect

   3. Please ensure that Require New Password at Next Sign In is not checked

   4. Session Timeout Minutes: 0

   5. Please ensure that Do Not Allow UI Sessions is checked

   6. Click OK to create the Integration System User

      

Step 3: Configure a Security Group

1. In the search bar at the top of the page, search for “Create Security Group” and click on the resulting task.

   

2. Fill in the following information to configure a security group:

   1. Type of Tenanted Security Group: From the dropdown menu, select Integration System Security Group (Unconstrained)

   2. Name: Finch

      

3. Click OK to create the security group. This opens the Edit Integration System Security Group (Unconstrained) page

4. Fill in the following information:

   1. Name: This should auto-populate as “Finch”.

   2. Integration System Users: Select the name of the Integration System User you created in Step 2

      

5. Click OK then Done to assign the Integration System User to the Security Group

6. In Finch Connect, click the Checkbox to confirm you’ve completed these instructions

Step 4: Configure the Domain Security Policy Permissions

1. In the search bar at the top of the page, search for “Maintain Permissions for Security Group” and click on the resulting task.

   

2. Fill in the following information:

   1. Operation: Maintain

   2. Source Security Group: Select the Security Group “Finch”

   3. Click OK

      

Configure the Domain Security Policy Permissions

Click the + and add the following 3 security policy permissions:

NOTE: View Only will not work**.** You must select Get Only.

1. Click OK to save the permissions

2. Click Done

Additional Permissions (Optional)

Please enable the additional Domain Security Policy(s) if the application you’re connecting to requires any of the data fields below.

Step 5: Activate Security Policy Changes

1. In the search bar at the top of the page, search for “Activate Pending Security Policy Changes” and click on the resulting task.

   

2. In the Comment box, write “Activate pending security policy changes”

   

3. Click OK

4. View the summary of changes waiting to be approved and check the Confirm checkbox

   

5. Click OK

6. In Finch Connect, click the Checkbox to confirm you’ve completed these instructions

Step 6: Configure Authentication Policy

1. In the search bar at the top of the page, search for “Manage Authentication Policies” and click on the resulting task.

   

2. Verify that the Security Group (Finch) is assigned to a policy that has an Allowed Authentication Type of User Name Password or Any.

   1. Click Edit

      

   2. Click the + button under Authentication Ruleset

      

   3. Fill in the following information:

      1. Set the Authentication Rule Name to “FinchRule”

      2. Set the Security Group to “Finch”

      3. Set the Authentication Condition Name to “FinchCondition”

      4. Set the Authentication Conditions to Any

      5. Set the Allowed Authentication Types to Specific > User Name Password.

3. Click OK to save

Step 7: Activate Authentication Policy Changes

1. In the search bar at the top of the page, search for “Activate Pending Authentication Policy Changes” and click on the resulting task.

   

2. Select the Authentication Policy Change you made in Step 6 and type Confirm in the comment box

   

3. Click OK

4. Check the checkbox to confirm

   

5. Click OK

6. Click Done

7. In Finch Connect, click the Checkbox to confirm you’ve completed these instructions

Step 8: Retrieve the Web Services Endpoint URL

1. In the search bar at the top of the page, search for “Public Web Services” and click on the resulting task.

   

2. Scroll down to find the Human Resources (Public) item in the Web Service column and hover over it so you can click the ... menu that appears

3. In the ... menu click Web Service > View WSDL. A new page will open containing the technical specifications for the Workday Human Resources Web Service

   

4. Scroll all the way to the bottom of the page and locate the line containing soapbind:address location=. You can also search within the page using Ctrl+F or Cmd+F for the text soapbind:address location=

   

5. Copy the URL up until /service. Your resulting Web Services Endpoint URL should look something like *<https://wd5-services1.myworkday.com/ccx

   

6. Paste the value into Finch Connect and click Connect