# Connect Workday for HR data

If you want to connect Workday to use for ASC 350-40 to retrieve employee title, ID, and other non pay data only, follow the below instructions.

If you want to connect Workday to use for ASC 350-40 to retrieve employee title, ID, and other non pay data only, follow the below instructions.

NeoTax uses [Finch Connect](https://www.tryfinch.com/company/security) to securely connect to and retrieve data from Workday.

## Before you start

Please ensure that you have **Administrator** privileges in Workday before continuing with the instructions below.

## Instructions

### Step 1. Create an Integration System User in Workday

1. Log in to your Workday portal.
1. In the search bar at the top of the page, search for “Create Integration System User”.
1. Select the **Create Integration System User** task.
1. Enter a **User Name** and **Password** of your choosing for the new Integration System User. Make sure the password does not contain any of the following characters: “&”, “”, “>”
1. Save this login information as you'll need it later.

   ![Screenshot from Connect Workday for HR data](https://assets.usepylon.com/d3019c90-1883-4980-a1fc-08e4414ea520%2F2a06618f-f5df-4404-9b43-dac5d5b03f32-26242546390164.png?Expires=253370764800&Signature=jbUzE3wSZKFscyje72tS0-QAcPpCmNuNKUQbn~qcy4d7Q0fkxo-yBPbb7-DxSfPRWisXy~8jg8w5boLv-ddZ72EOxgnJtaPxrH-VnJHbazyuNJ63BsFsEsB5RtvzZ4Kzqlh87Z25SUjdX8xChtGrYH-kwPJYYwRCUsAwOqNro99oRefFYEj3hf65gGW5cTgECXELzobXfkUl6Kk~yzZZD-syoObhYpf9eo0ITBGJthLlF1Jmz31GmBvDR9o98vfbDC76SJFNfruMZLqfxwKNgi87nsWdyxN8hINklM5BWpLEux6gD6ywq8EH7X9IDa-2fntgV-pXSbA-okVH9mhJLg__&Key-Pair-Id=K3NV4LZ47N8M46)
1. Please ensure that **Require New Password at Next Sign In** is not checked.
1. Set **Session Timeout Minutes** to 0.
1. Please ensure that **Do Not Allow UI Sessions** is checked.
1. Click **OK** to create the Integration System User.

### Step 2. Configure a Security Group

1. In the search bar at the top of the page, search for “Create Security Group”.
1. Select the **Create Security Group** task.
1. On the **Create Security Group** page, from the **Type of Tenanted Security Group** dropdown, select **Integration System Security Group (Unconstrained)**.
1. Enter a name for the security group in the **Name** field.
1. Click **OK** to create the security group.
1. On the **Edit Integration System Security Group (Unconstrained)** page enter the name of the Integration System User you created in the **Integration System Users** field

   ![Screenshot from Connect Workday for HR data](https://assets.usepylon.com/d3019c90-1883-4980-a1fc-08e4414ea520%2F1c814bc4-2fcf-49b9-9320-d40ed219a022-26242546395284.png?Expires=253370764800&Signature=r-tgNioMbBlp2nGsceYtgly5aTwMn39xyvb-WRfgi7jFYsjxQnxpH18tXXyD-UM1VOHo8SUZCZPbRXzlfHxq-yw60k86nEyO2294ZJkXjy8UsoxXoUNoW7zDKVGK-hPzPziAYOmUyoTmD5JRafNoYsOX3bghEYtBuIfDEQAi7rVbFD7QADU03Ecrrcy6E68SABjTMPcBruyk~bOQmj3GaiN4MAs0A-q4p9wY1oXD9TeQaUHA-H10kuFv6jZ1i87sna4~Ysp1JHGOxXv6r9PAJIA3l6fCHG~7-XqweKn57XjXuUfqv2R3R6ahBC8IM7-w6i~a9RIM~r3IuG1nbqmjrg__&Key-Pair-Id=K3NV4LZ47N8M46)
1. **Click OK to assign the Integration System User to the security group.**

### Step 3. Configure the Domain Security Policy Permissions

1. In the search bar at the top of the page, search for “Maintain Permissions for Security Group”.
1. Select the **Maintain Permissions for Security Group** task.
1. Make sure the **Operation** is **Maintain**, and the **Source Security Group** is the security group you created.
1. Configure the **Domain Security Policy Permissions** based on the requirements of the Workday integration you are connecting and the information below.

#### Required Domain Security Policies

The following **Domain Security Policies** are the minimum set that are required in order to connect:

**NOTE - View Only will not work. You must select Get Only**

|  |  |  |
| --- | --- | --- |
| **View/**<br>**Modify Access** | **Domain Security Policy** | **Notes** |
| Get Only | Set Up: Company General | Required for authentication |
| Get Only | Worker Data: Public Worker Reports | Required to fetch basic employee data that is typically made publicly accessible by other employees |
| Get Only | Worker Data: Current Staffing Information | Required to fetch basic employee job role data |

#### Required Domain Security Policies

The following **Domain Security Policies** enable NeoTax to retrieve additional data.

**NOTE - View Only will not work. You must select Get Only**

|  |  |  |
| --- | --- | --- |
| **View/Modify Access** | **Domain Security Policy** | **Notes** |
| Get Only | Person Data: ID Information | Enables fetching employee social security numbers (SSN) on the /individual endpoint |
| Get Only | Person Data: Date of Birth | Enables fetching employee date of birth (DOB) on the /individual endpoint |
| Get Only | Person Data: Gender | Enables fetching employee gender on the /individual endpoint |
| Get Only | Person Data: Ethnicity | Enables fetching employee ethnicity on the /individual endpoint |
| Get Only | Person Data: Work Contact Information | Enables fetching employee work emails and phone numbers |
| Get Only | Person Data: Home Contact Information | Enables fetching employee personal emails and phone numbers |
| Get Only | Integration Build: Get References | Enables fetching readable descriptions for reference IDs used by custom fields. These IDs are related to custom organization types and bonus plan types |

Do **NOT** enable any Domain Security policies related to pay data.

### Step 4. Activate Security Policy Changes

1. In the search bar at the top of the page, search for “Activate Pending Security Policy Changes”.
1. Select the **Activate Pending Security Policy Changes** task.
1. View the summary of changes waiting to be approved and check the **Confirm** checkbox

![Screenshot from Connect Workday for HR data](https://assets.usepylon.com/d3019c90-1883-4980-a1fc-08e4414ea520%2F6bef8b0a-9b9c-411d-9d32-348ad952a84e-26242546401812.png?Expires=253370764800&Signature=It5l13hmg1AH8RbHUSci79Wo2QNuSU2-EHr1HxtwDWXHU6awHNIgViASnia1eON14tsTpdQo-4jHcxsuUUwOgkwAGzHPA1CbLVERzOfIfJLZOLLkEDOY3YE97xklGaOcnxHald9ulUCK5MA~6X7Sdo9YRJurZCekE6djkI4CQSYZz~el6xPIBn1Veh~Djkog0VVV7YxdSEb6o754GRUG3V8aV3a8L990F7jaK-~i4lVC9am90rmejl-6rfjxyJsv56x-Mo-hNgLFG054ake6SCogyRMizarJfZXHUuDr6aUTyLMOHXHdVTK0rSjZ2~Tdaoc2QD8WKoy0YCyKIsqYlQ__&Key-Pair-Id=K3NV4LZ47N8M46)

### Step 5. Configure Authentication Policy

1. In the search bar at the top of the page, search for “Manage Authentication Policies”.
1. Select the **Manage Authentication Policies** report.
1. Verify that the Security Group is assigned to a policy that has an **Allowed Authentication Type** of **User Name Password** or **Any**. If this is not the case you must edit the relevant Authentication Policy to add a rule using the steps below:

- **Edit** the Authentication Policy for the environment you want NeoTax to retrieve data from
- **Add** a new Authentication Rule for the policy
- Set the **Authentication Rule Name** to a unique value to identify the rule
- Set the **Security Group** to the Security Group you created
- Set the **Authentication Conditions** to **Any** and the **Allowed Authentication Types** to **Specific** > **User Name Password**.

![Screenshot from Connect Workday for HR data](https://assets.usepylon.com/d3019c90-1883-4980-a1fc-08e4414ea520%2F544b3c89-de3d-4702-bf1b-efd251d30aa2-26242546413844.png?Expires=253370764800&Signature=mdTQEh9yNHTusgzCMb3D6WN1RhtwWppXFPyncS9KfY5YVlSjMLgDp0vhuXJxmsa92lh5PmML504XbQe8RnGxF6xDGxoPAscnG7GWp3qMLAYW~SbvwSLrsIyA9c6KGbzLiee9qPywUn07uVQxh5vxGjVzGBllgJUyFo3iS4Z3reTcWtyo1YO0p-yPQjhPP4F4hnQCQN7RDJwLj8IpemWSF4o0DbIfCzXw4gQKMxgClLui4NbWOg0ctaM4MepUtidjdGxBfgSGoXshjxpQyBXKj8sILaRAAShoMwMyWyY-xLSAyxouscyWzL~4qL2wdGRykfzRu22-RRpNm7qhKjMhWQ__&Key-Pair-Id=K3NV4LZ47N8M46)

![Screenshot from Connect Workday for HR data](https://assets.usepylon.com/d3019c90-1883-4980-a1fc-08e4414ea520%2F3add5933-6f78-4128-8a2b-d6170550aac1-26242518328212.png?Expires=253370764800&Signature=jG6aKUjflJ1umAaPpflZ6SNUmwGePJIrJzYPk4QDmqQrqhgrgQTWMdR4QNnTGQWoYvui8jPCHtJpyP-lHRn2NprhENGhNxBuUXE1ZEwLyJEDZuBXhxtjZfCd~RPyl8GipAfTVYL3aGsSTB~E8I76lAzDbrB22JMHALB3ANj~sGLu0MtQEOhBcV7lu~p4PldQVxofx-TXfC9d3fHsLkhCp3E1CduLWErdabb4b9UWP6hqgj4Vo7OVtKYSqUk9VNj951pUppUd3zs--88PQtkubhiWF-3Xlt9Uc0SymIUlWYLZcMvgum8Q0hDnw9OIbXANJ4up4D3vQZ9EqDeVd-DiFg__&Key-Pair-Id=K3NV4LZ47N8M46)

![Screenshot from Connect Workday for HR data](https://assets.usepylon.com/d3019c90-1883-4980-a1fc-08e4414ea520%2F6cd7d9bd-99c1-4c69-a90a-b7614bedc13c-26242546435220.png?Expires=253370764800&Signature=u8lXXaHrutOe3LdcBtDZce~x~HfH8dU679UD606roN7~DhpUxQgUKaYSLHXT~BYRQ0VC~o7aLY4zYLRNTWYE0xxz6f3LpXhtokiIO9q5~Kq1mQtKeGDtLnAbfRSDhYf1lqEGrMtNboAAxFnn32ADudHVen3P9aQDvMQbn~pjqi7xBnjMXEwXjjzqxzPx197ea3pbs2QnqUmFfB3Wili0NJBaO401Gc~tDgzie2CdelU~mV55IK--lk90Ad77qbhBTq7DV8am9Bs6dijcP-1v0xXAUnqMlM5tWc3cxx20Ieh-iANNnqaBJu6ammOaakWR3tPDJbEvQu~Q9P5nl~czyA__&Key-Pair-Id=K3NV4LZ47N8M46)

### Step 6. Activate Authentication Policy Changes

1. In the search bar at the top of the page, search for “Activate Pending Authentication Policy Changes”.
1. Select the **Activate Pending Authentication Policy Changes** task.
1. View the summary of changes waiting to be approved and check the **Confirm** checkbox

![Screenshot from Connect Workday for HR data](https://assets.usepylon.com/d3019c90-1883-4980-a1fc-08e4414ea520%2Fb8859e28-0ca7-4626-92ae-6f8f4beed8e5-26242546443412.png?Expires=253370764800&Signature=GSQI6OPT~4UpLiTRhi-fElvlmjdY7~njRDFv8qBXtfkZUTanRFx13nAvOZ0cpvFcgnYf7eldDNVUf5MMh35J5mqs4SqiTC1exIl37yz5LT02w7EaAxBtk6Bbi5bPFJJlh7Y0m8iSp2Ya1~9Lytj-VNGZmtqzn3H31UTxaVlcfUGkDUpfoQOksB86NZy7L2PqESarI3Nn4br-Z21C8bbk-2XmHK81r6Dw~LFdXvA7TN4TSHFF3iJ3ISE96l4Wllu7vUN6MzF0RiMinsYEDYRx8Xu7QaALdK5FQtpwbpCDDiCsb0fQkLMQOEhnJiohBN~9dtyOAzz4J8jYZewVKWIXEA__&Key-Pair-Id=K3NV4LZ47N8M46)

### Step 7. Obtain the Web Services Endpoint URL

1. In the search bar at the top of the page, search for “Public Web Services”.
1. Select the **Public Web Services** report.
1. Find the **Human Resources (Public)** item in the **Web Service** column and hover over it so you can click the **...** menu that appears.
1. In the **…** menu click **Web Service** > **View WSDL**. A new page will open containing the technical specifications for the Workday Human Resources Web Service.
1. Scroll all the way to the bottom of the page and locate the line containing **soapbind:address location=**. You can also search within the page using **Ctrl+F** or **Cmd+F** for the text **soapbind:address location=**
1. Copy the URL up until */service*. Your resulting **Web Services Endpoint URL** should look something like [*https://wd5-services1.myworkday.com/ccx*](https://wd5-services1.myworkday.com/ccx)

   ![Screenshot from Connect Workday for HR data](https://assets.usepylon.com/d3019c90-1883-4980-a1fc-08e4414ea520%2F329dd156-bdb8-4f4f-a420-a27607968c13-26242518355988.png?Expires=253370764800&Signature=rDFU6z8mBnXDc1OnoKKVTH7vSZPaJtgMWD49U7ksthJSs1PcP8qWDGm0EYVMqu5yBctDHWCfylWmLfd8nwaeN06oREM9WivF3SD81BKXI-uNxKDA2g~Th3zoebAUVt3eV-LXkuVEjlYf2SDKO7Mc~CYsPIoqUjm7ESNR8wgyuSWQYalh06BiQ9H99-ajnlZlBy~gX00pBLJS8eY2VLvo9iPb8W5sdPKlnytlKkPYo9hmP2nFSF56uaBse~JbDq~jCkc11~rRQFkCESzyskxGEo8FRFXNP~5boJxt1B0ExFMf3JRYbd8xwWaL7QR-zqetcmc4vFyKPhPfPhhvYc4TzA__&Key-Pair-Id=K3NV4LZ47N8M46)
1. Save this URL to provide in NeoTax > Finch Connect.

### Step 8. Go to NeoTax and Connect the Token

1. Navigate back to [NeoTax](https://app.neo.tax/) > go to R&D > Select Payroll > Workday > Click Connect > Open Workday.

   ![Screenshot from Connect Workday for HR data](https://vaffozzswoq4jjsz.public.blob.vercel-storage.com/help-center/d05270dc-1eaf-4b40-bc61-f6729ded00b4/workday-hr-only-1.png)

   1. The instructions will reference pay data. You can ignore that part, since you’ve restricted the token to only have employee data in the above steps.
1. Paste the username and password created in Step 1 into the **Username** and **Password** fields.
1. Paste your **Workday tenant ID** into the **Tenant ID** field. You can find this value in the URL of your web browser when on the Workday home page:

- If the URL looks like [*https://impl.workday.com/somecompany*](https://impl.workday.com/somecompany) then your tenant ID is somecompany
- If the URL looks like [*https://somecompany.workday.com*](https://somecompany.workday.com/) then your tenant ID is somecompany

  **This value is case-sensitive, make sure the case matches what's in your URL.**

1. Paste the **Web Services Endpoint URL** you copied in Step 7 into the **API Base URL** field.
1. Click **Connect.**

### Step 9. Select a Company to Connect

The modal will ask you to select which company you’d like to connect. This is a list of companies retrieved from your Workday system that employees area is assigned to.

The company you connect will be the only company NeoTax will retrieve data for.