Workday Access Requirements - Approvals
Workday Access Requirements - Approvals
Workday Access Requirements - Approvals
You will need to provide the following to Moveworks.
👉 Provide provide ALL of the above to your Moveworks Customer Success team via encrypted email.
Please create an Integration System User (ISU) and Integration System Security Group (ISSG).
Create Integration System User (ISU) Workday Task.
Create Integration System User (ISU) Workday Task to create a user following these settings. Write down the username and password that you use.
Create Security Group task.
Integration System Security Group (Unconstrained) (ISSG). Title it “ISSG_Moveworks” for best practices.
All Workday Accounts report to find the account again.
Assign Integration System Security Groups.
View Security Group Report.
Activate Pending Security Policy Changes task.
Note: The Modify and Put permissions are not necessarily required to identify users. The View and Get permissions should be enough for the use case. However, we might need to explore those permissions too if we fail to fetch users using the View and Get permission types.
Please create an API Client for Integrations and provide the following function areas (scopes). Then create a refresh token for the ISU you created earlier.
Register API Client for Integrations.
View API Clients. Write down the Token Endpoint and Workday REST API Endpoint.
View API Clients view, click on the API Clients for Integrations tab. Click on the API Client you just created.
Manage Refresh Tokens for Integrations.
Generate Refresh Token.
Check the box for OAuth 2.0 Clients Enabled
Access the Edit Teams Setup – Security task and select the checkbox for OAuth 2.0 Clients Enabled
Follow the above step with the help of this screenshot and box in red
Create each of the following reports into your Workday instance. Transfer ownership to our ISU, then share the JSON URL with your Moveworks Customer Success team.
We use this report to detect when new approvals are pending in your Workday instance.
When generating the JSON URL, provide any Business Process Definitions that you would like Moveworks to support.
Approval Mirroring: When configuring Workday PTO Approvals, the Approval Retrieval Report URL typically contains a Business_Process_Names prompt parameter. Extract the Business_Process_Names!WID value from the URL and add it as a bp_names!WID key-value pair in the Approvals Config Report Params section of the Workday connector configuration. This step is required to ensure PTO approval requests are retrieved correctly.
We use this report to get time off details for our approval notifications.
You can provide any values for the prompts when generating the JSON URLs, it doesn’t matter.
Repeat the steps below for EACH report you need to create, which are the Approval Retrieval Report and the Time Off Details by ID Report.
Create Custom Report task.
Warning: Make sure to copy over all tabs EXACTLY. The naming and capitalization are both important.
View URLs under Web Service to get the URL of the Custom Report.
JSON and Copy URL. Share this URL with your Moveworks Customer Success team.
We recommend doing this so that our ISU has access to report even if a member of your Workday Reports team leaves the company.
Create a User-Based Security Group and assign our ISU to it. Then, update the Business Process Security Policy to grant Moveworks the permissions to review the relevant action steps. Then, update the Business Process Definition to add your User-Based Security Group to the Approval step(s).
We need to setup additional permissions for approvals to allow the ISU user to approve business processes in Workday. Please create a User-Based Security Group to add support for your approvals across various processes.
Create Security Group task.
User-Based Security Group called Moveworks.
Assign Users to User-Based Security Group task.
Warning: You’ll need to repeat the following steps for EACH business process you want users to be able to approve through Moveworks. You can see the list of business process types to update here.
Edit Business Process Security Policy task and select one of the business processes from the list shown below.
Moveworks Security Group to any required Security Policy Action Step from the list shown below.
Activate Pending Security Policy Changes task.
