HRIS

Workday

Connect Workday to Ploy to sync employee data and run access reviews from a single integration. The current Workday integration is read-only: it does not provision or revoke access in Workday.

Before you start

  • Decide whether to use OAuth or Basic Auth. OAuth unlocks REST-based account discovery and user search; Basic Auth supports RaaS reports only.

  • For OAuth, register an API Client for Integrations in Workday, enable non-expiring refresh tokens, and generate a refresh token for the Integration System User (ISU).

  • For Basic Auth, obtain the ISU username and password.

  • Prepare your Worker RaaS report URL from Workday.

OAuth is required for full account sync and user search. Basic Auth cannot call Workday REST APIs, so identity data comes only from your RaaS report.

Connect Workday

  1. In Ploy, go to Integrations.

  2. Select the Workday widget and click +Add.

  3. Enter your Workday Tenant Hostname and Workday Tenant Name.

  4. Select your Authentication Method.

    • OAuth: Enter API Client ID, API Client Secret, and Refresh Token.

    • Basic Auth: Enter Integration System User Username and Integration System User Password.

  5. If using Basic Auth, toggle Workers in the report all have Workday logins if your Worker RaaS report includes workers with Workday login accounts. This lets Ploy derive identity data because Basic Auth cannot use REST.

  6. Click Test to verify the connection.

  7. Enter your Worker Report URL (RaaS). The URL must use HTTPS and be hosted on a workday.com or myworkday.com domain.

  8. Optional: toggle Sync Workday security groups, then enter your Security Groups Report URL (RaaS).

  9. Map the Worker Report columns to Ploy fields.

  10. If syncing security groups, map security_group_id, security_group_name, and member_worker_id, plus optional security_group_type and member_account_id.

  11. Review the preview and click Save to enable the integration.

Data synced from Workday

  • Workers as members from the Worker RaaS report

  • Organisational units and role assignments from the Worker RaaS report

  • Workday accounts and identities via REST (OAuth only)

  • Security groups and memberships (if enabled)

Troubleshooting

  • If the test fails with an authentication error, verify that your refresh token is valid and has not expired, or that your Basic Auth credentials are correct and have sufficient permissions.

  • If Workday user search is unavailable, confirm the integration is configured with OAuth. Basic Auth cannot search Workday users.

  • If the Worker Report URL is rejected, confirm it uses HTTPS and is hosted on a workday.com or myworkday.com domain.

Was this helpful?
Was this helpful?