Skip to main content

Connecting Workday HRIS with Sana

Disa Roth avatar
Written by Disa Roth
Updated over 3 weeks ago

If you sync user data with Sana, you can then use the user metadata to automatically enroll the right user to the right content at the right time, pull out custom reports, or set the right permissions on groups of users based on your org structure.

Why should you sync your users in Workday with Sana?

Syncing your users in Workday with Sana offers several benefits:

  • Easy user management: Automatically update user profiles in both systems, saving time and reducing errors.

  • Accurate data: Keep user information up-to-date and consistent across both platforms.

  • Smooth onboarding and offboarding: Automatically enroll new employees in training and deactivate users who leave.

  • Better reporting: Combine data from both systems to create detailed reports.

  • Save time and costs: Automate repetitive tasks like user updates, freeing up time for more important work.

By syncing your users in Workday with Sana, you can make your HR and learning processes more efficient and effective. For a general guide on syncing your HR system with Sana, including Workday and other systems, check out Synching your HR system with Sana.
​
Now, let's walk through the steps to generate credentials in Workday for user provisioning in Sana:

💡 To follow the below steps you require administrative access on your organization's Workday account.

Step 1: Create an Integration System User

  1. In Workday, use the search bar to navigate to the Create Integration System User task, and click on the option presented. (see screenshot 'Step 1.1' below)

  2. Create a new Username (in this example we'll use 'workday_user_provisioning' and Password. Ensure you have a copy of this information as you will need it later.

  3. Ensure the following fields are set as stated below:

    1. 'Require new password at Next Sign in' is unchecked

    2. 'Session Timeout Minutes' is set to '0'.

    3. 'Do Not Allow UI Sessions' is checked

  4. Click OK to create the integration system user.

👉 Make a note of your Username and Password as it will be needed for the integration request.

Step 1.1

Step 1.2-1.4

Step 2: Create an Integration Security Group

  1. Use the search bar to navigate to the Create Security Group task.

  2. For the Type of Tenanted Security Group drop down select Integration System Security Group (Unconstrained)

  3. Create a name for this security group, for example, 'sanalabs demo_user_provisioning'

    👉 Make a note of this as you will need it in the next step and click OK.

  4. In the Integration System User field select the name you created in step 1 ('workday_user_provisioning')

  5. Click OK

  6. Click Done

Step 2.2 - 2.3

Step 2.4 - 2.5

Step 3: Set Up Domain Security Policy Permissions

  1. Use the search bar to navigate to the Security Group Membership and Access report.

  2. In the Security Group field type and then select the Security group you created in step 2 ('sanalabs_demo_user_provisioning') and press OK.

  3. Once the request has processed, hover over the 'sanalabs_demo_user_provisioning' group, click the 3 dot menu and select Maintain Domain Permissions for Security Group (see screenshot 'Step 3.3' below)

  4. You'll be taken to a new page to apply Integration permissions - find the permissions on the drop down. Click OK once the permissions have been added.

Click here for integration permissions info

In the Domain security policies permitting Get access field search 'worker' then check all of the listed permissions below

Permissions:

Worker Data: Workers

Worker Data: Onboarding

Worker Data: Qualified Workers

Worker Data: Worker ID

Worker Data: Job Family on Worker Profile

Working Data: Dependents

Worker Data: Calibration

Worker Data: Establishments

Worker Data: Beneficiaries

Worker Data: Benefits

Worker Data: Compensation

Worker Data: Mentoring

Worker Data: Reports

Worker Data: Connections

Worker Data: Staffing

Worker Data: Payroll

Worker Data: Interests

Worker Data: Gigs

Worker Data: Succession

Worker Data: Talent

Step 3.2

Step 3.3

Step 4: Activate the Security Policies

  1. Use the search bar to navigate to the Activate Pending Security Policy Changes task

  2. Enter a comment, for example, 'activated demo_course'

  3. Click OK, then review the permissions

  4. Check the Confirm check box and click OK

  5. The next page will confirm activation

Step 4.2

Step 4.4

Step 5: Register the API Client for Integrations

  1. Use the search bar to navigate to the Register API Client for Integrations task.

  2. In the form that appears, fill in:

    • Client Name: e.g., ACI_Sana_HCM

    • Non-Expiring Refresh Tokens: Checked

    • Disabled: Unchecked

    • Scope (Functional Areas): Add at least Worker Profile and Skills, Staffing, System

    • Include Workday Owned Scope: Unchecked

    • Restricted to IP Ranges: None
      (see screenshot 'Step 5.2' below)

  3. Click OK.

  4. On the next page, you'll be able to see your Client ID and Client Secret.

👉 Make note of the Client ID and Client Secret as you will need to share these with your Sana Integrations specialist.

Step 5.2

Step 5.4

Step 6: Generate a Refresh Token

  1. Use the search bar to navigate to the View API Clients report.

  2. Take note of the Workday REST API Endpoint, Token Endpoint, and Authorization Endpoint as you will need to share these with your Sana Integrations consultant. (see screenshot 'Step 6.2' below)

  3. Select the API Clients for Integrations tab and locate the API Client created in the previous step. Press the 3 dots and select API Client > Manage refresh tokens for Integrations.

  4. In the pop-up that appears, select the ISU created in an earlier step.

  5. Tick Generate New API Token and press OK. A new refresh token will appear in the list.

👉 Make note of this as you will need to share it with your Sana Integrations consultant.

Step 6.2

Step 6.3

Step 6.5

Step 7: Create a Custom Report and Obtain the WQL Query

  1. Use the search bar to navigate to the Create Custom Report tab. In the dialog, name the report, select Report Type: Advanced, and Data Source: Workers for HCM Reporting. (see screenshot 'Step 7.1' below)

  2. Create a report that comprises all the data that you would like to use in Sana. At a minimum, add Workday ID, First Name, Last Name, and Email Address. You may also add other metadata like title, department, location, etc.

  3. Save the report.

  4. Use the search bar to navigate to the Convert report to WQL report. In the dialog, select the custom report you just created. A new screen will appear. Take note of the query under the heading “Converted WQL Query String”. It should look something like:
    ​

    SELECT workdayID, firstName, lastName, email_PrimaryWork FROM workersForHCMReporting

Step 7.1

Step 7.2

Step 8: Share with Sana

After completing the above steps, you should have the following information:

  • Client ID and Client Secret (from Step 5)

  • Refresh Token (from Step 6)

  • Workday REST API Endpoint, Token Endpoint, Authorization Endpoint (from Step 6)

  • WQL Query String (from Step 7)

Please provide this information to your Sana CSM or Integrations consultant to complete the integration process.

💡 Remember, the steps above are for a demo scenario. The names and settings you use may vary based on your organization's specific needs and policies. Always ensure you're following your organization's security guidelines when creating and managing users and permissions

Related Articles
Connecting LinkedIn Learning with Sana
Synching your HR system with Sana
Connecting Workday Learning with Sana
Sana Integration Capabilities
User provisioning with Salesforce
Did this answer your question?