Connecting Workday to Drata allows for automated checks and evidence collection to provide details on personnel hire and separation dates as well as their employment status.

Key Capabilities

Personnel synchronization: Syncs employment status, hire dates, and key personnel attributes from the HRIS.
Lifecycle classification: Uses HRIS data to detect hire and termination events that support onboarding and offboarding compliance requirements.
Read-only ingestion: Retrieves HR data using read-only access without modifying information in the HRIS system.

Prerequisites & Data Access

Before setting up the Workday connection in Drata, make sure you have the required credentials and the appropriate Drata permissions.

Choose an Authentication Method

You can connect to Workday using either of the following authentication methods:

Use my credentials (recommended): Uses an Integration System User for authentication. If using "Use my credentials (recommended)", you must provide the following:
- WSDL
- Workday Tenant Name
- ISU Username
- ISU Password
OAuth Credentials: Uses OAuth tokens and client credentials. If Using OAuth Credentials, you must provide the following:
- WSDL
- Workday Tenant Name
- Client ID
- Client Secret
- Refresh Token
- Token Endpoint

Required Permissions

Must be a Workday Admin.
Must be assigned one of the following Drata roles: Admin, Workspace Managers, DevOps Engineer.
If you have the Access Reviewer Drata role, you can only view the Connections page.

Step-by-Step Setup

Step 1: Select a Connection Method

Choose how you want to authenticate with Workday. You can connect using either:

Use my credentials (recommended) — Uses an Integration System User (ISU) for authentication.
OAuth Credentials — Uses OAuth client credentials and tokens.

The setup steps will vary depending on the method you select.

Step-by-Step Setup (For those who use credentials)

Step 1: Create an Integration System User (ISU)

In your Workday portal, log into the Workday tenant
In the Search field, type Create Integration System User
Select the Create Integration System User task
On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password
- Important: "&", "", or ">" characters cannot be included in the password
Click OK
To ensure the password doesn't expire, you'll want to add this new user to the list of System Users.
- To do this, search for the Maintain Password Rules task.
Add the ISU to the System Users exempt from password expiration field
Enter the Integration System User name in the connection flow or Save the Integration System User name and password. You will need it during the connection process.

Step 2: Create a Security Group and assign an Integration System User

In the Search field, type Create Security Group.
Select the Create Security Group task.
On the Create Security Group page, select Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group pull-down menu.
In the Name field, enter a name and select OK.
On the Edit Integration System Security Group (Unconstrained) page, in the Integration System Users field, enter the same name you entered when creating the ISU in the first section
Click OK

Expected outcome:
The ISU is assigned to a security group that will control its access.

Step 3: Configure domain security policy permissions

In the Search field, type Maintain Permissions for Security Group
Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2
On the next screen, add the corresponding Domain Security Policies depending on your use case:

Note:

If you are connecting to Workday HRIS: Follow our HRIS Permissions guide
If you are connecting to Workday ATS (Recruiting): Follow our ATS (Recruiting) Permissions guide

Step 4: Activate security policy changes

In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved
Add any relevant comments on the window that pops up
Confirm the changes in order to accept the changes that are being made and hit OK

Step 5: Validate the authentication policy is sufficient

Search for Manage Authentication Policies
Click Edit on the authentication policy row
Create an Authentication Rule
Enter a name, add the Security Group, and ensure Allowed Authentication Types is set to Specific User Name Password or Any

Note: You don't have to create a new Authentication Rule if you already have an existing one set to User Name Password or Any. You can add the ISU you created to that rule instead.

You will need to create a new rule if SAML is the only Authentication Rule you see for "Allowed Authentication Types."

Step 6: Activate all pending authentication policy changes

In the search bar type, activate all pending authentication policy changes
Proceed to the next screen and confirm the changes. This will save the Authentication Policy that was just created or edited

Step 7: Obtain the web services endpoint URL

Search in Workday for Public Web Services
Find Human Resources (Public) if you are connecting Workday HRIS.
Find Recruiting if you are connecting Workday ATS.
Click the three-dot menu (⋯) to open the options menu, then select Web Services → View WSDL.
Navigate to the bottom of the page that opens (it may take a few seconds to load)
Copy the full URL provided under Human_ResourcesService (Workday HRIS) or RecruitingService (Workday ATS).
- The URL will have a format similar to https://wd2-impl-services1.workday.com/ccx/service/acme/Human_Resources/v43.0
Enter the Web Services Endpoint URL into the connection flow.

Step-by-Step Setup (Using OAuth Credentials)

Step 1: Obtain the web services endpoint URL

Search in Workday for Public Web Services
Find Human Resources (Public) if you are connecting Workday HRIS.
Click the three-dot menu (⋯) to open the options menu, then select Web Services → View WSDL.
Navigate to the bottom of the page that opens (it may take a few seconds to load)
Copy the full URL provided under Human_ResourcesService (Workday HRIS). The URL will have a format similar to https://wd2-impl-services1.workday.com/ccx
Enter the Web Services Endpoint URL prefix into the connection flow.

Step 2: Enter in your tenant name (subdomain)

From the web services URL find your tenant name. In this example, the value is "acme"
Enter the tenant name into the connection flow.

Step 3: Register a new API Client for Integrations

In the Search field, select the Register API Client for Integrations (Task).
On the Register API client for Integrations page,
- In the Client Name field, enter a name for the client.
- Select Non-Expiring Refresh Tokens.
- Enable Include Workday Owned Scope.
- In Scope (Functional Areas), select the following:
  - Staffing
  - Public Data
  - Tenant Non-Configurable
  - Time Off and Leave (required only if you need access to Time Off data)
  - Contact Information
Click Ok. Save the Client Secret and Client ID. Click Done.
Enter the Client Secret and Client ID to the connection flow.

Step 4: Generate a non-expiring Refresh Token

In the Search field, select View API Client.
On the View API Clients page, click the API Clients for Integrations tab. Save your Token Endpoint.
Click the client you created in previous step (Step 3: Register a new API Client for Integrations)
Open the three dots > API Client > Click on Manage Refresh Tokens for Integrations
On the Manage Refresh Tokens for Integrations page, in the Workday Account field add a user. Save your Refresh Token.
Add your Token URL and Refresh Token to the connection flow.