Integrating Workday with TeamOhana

Last updated: July 8, 2025

Workday Authentication and Permissions

Overview

To authenticate your Workday account, you will need to provide the following information:

  • WSDL

  • ISU Username

  • ISU Password

  • Workday Tenant Name

Prerequisites

Please ensure you fulfill all the requirements to set up the integration:

  • You have Administrator permissions in your company's Workday instance

Step 1: Create an Integration System User (ISU)

  1. In your Workday portal, log into the Workday tenant

  2. In the Search field, type Create Integration System User

  3. Select the Create Integration System User task

Create ISU.png

  1. On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password

    1. Important: "&", "", or ">" characters cannot be included in the password

  2. Do not check Require New Password at Next Sign In box

    Workday ISU.png

  3. Click OK

  4. To ensure the password doesn't expire, you'll want to add this new user to the list of System Users.

    1. To do this, search for the Maintain Password Rules task.

      Maintain password rules.png

    2. Add the ISU to the System Users exempt from password expiration field

      Add ISU.png

    Securely save your Integration System User name and password. You’ll need these credentials later to complete the setup in TeamOhana.

Step 2: Create a Security Group and assign an Integration System User

  1. In the Search field, type Create Security Group

  2. Select the Create Security Group task.

    Create Security Group.png

  3. On the Create Security Group page, select Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group pull-down menu.

    Unconstrained.png

  4. In the Name field, enter a name

  5. Click OK

  6. On the Edit Integration System Security Group (Unconstrained) page, in the Integration System Users field, enter the same name you entered when creating the ISU in the first section

    Edit Security Group.png

  7. Click OK

Step 3: Configure domain security policy permissions

  1. In the Search field, type Maintain Permissions for Security Group

    Maintain permissions.png

  2. Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2

    Source Security.png

  3. On the next screen, add the corresponding Domain Security Policies depending on your use case:

    Domain Security.png

  4. Add each one of the permissions that are required for HRIS data from this guide: Workday - What permissions do I need for HRIS data in TeamOhana?

    This part is very important, as these are the permissions that the integration will have within your Workday environment. If you do not configure the correct permissions, it is very possible that this authentication process does not succeed in TeamOhana, or it is possible there is missing data within your integration.

Step 4: Activate security policy changes

  1. In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved

  2. Add any relevant comments on the window that pops up

  3. Confirm the changes in order to accept the changes that are being made and hit OK

Step 5: Validate the authentication policy is sufficient

  1. Search for Manage Authentication Policies

  2. Click Edit on the authentication policy row

  3. Create an Authentication Rule

  4. Enter a name, add the Security Group, and ensure Allowed Authentication Types is set to Specific User Name Password or Any

Note: You don't have to create a new Authentication Rule if you already have an existing one set to User Name Password or Any. You can add the ISU you created to that rule instead.
You will need to create a new rule if SAML is the only Authentication Rule you see for "Allowed Authentication Types."

Step 6: Activate all pending authentication policy changes

  1. In the search bar type, activate all pending authentication policy changes

  2. Proceed to the next screen and confirm the changes. This will save the Authentication Policy that was just created or edited

Step 7: Obtain the web services endpoint URL

  1. Search in Workday for Public Web Services

  2. Find Human Resources (Public) if you are connecting Workday HRIS.

  3. Click the three dots to access the menu. Click Web Services > View WSDL

  4. Navigate to the bottom of the page that opens (it may take a few seconds to load)

  5. Copy the just the Web Services Endpoint URL prefix provided under Human_ResourcesService (Workday HRIS). The URL will have a format similar to https://services1.myworkday.com/ccx

    Workday URL.png

Enter Credentials into TeamOhana

  1. Log in to TeamOhana

  2. Go to Settings > Integrations > Link HRIS

    image.png

  3. Select Workday

  4. Click on Use my credentials (recommended)

  5. Select I am an admin

  6. Enter the Integration System Username and Password you saved from Step 1

    image.png

  7. Click Next until you get to Step 7/7 where you need to Enter your Web Services Endpoint URL prefix from Step 7

    image.png

  8. Click Submit

Important Notes

  • Implementation/sandbox tenant Workday accounts will result in slower syncs, as fewer resources are dedicated to the tenant

    1. In order to increase resourcing for API limits for your Workday tenant, please reach out to Workday Support or your Workday Customer Account Manager.

      • You can submit a request to Workday Support through the Workday Community support portal