Workday Real-Time Sync Setup Guide Skip to main content
https://support.okta.com/help/oktaarticledetailpage?childcateg=&id=ka0f0000000u5r7kac&source=documentation&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fdocumentation%2fknowledge_article%2fworkday-real-time-sync-setup-guide
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Workday Real-Time Sync Setup Guide
Published: Jul 30, 2015   -   Updated: Jun 22, 2018
Prerequisites
Okta Setup
Workday Setup

Workday Real Time Sync (RTS) allows Okta to receive user creation, update, and termination events from Workday on a real-time basis. Improvements include the following features:

  • Updates to Workday user information are immediately reflected in Okta and in downstream apps.

  • Real-time termination improves security, as the feature instantly removes a terminated employee’s access to sensitive files and email.

  • Real-time sync uses incremental updates to improve import performance. Existing scheduled imports can potentially contain thousands of users, taking 10 or more hours to complete.

User-added image
 
Best Practice: It is highly recommended that RTS be used in combination with scheduled imports that are run on a 1-2 day interval. This is because some less frequent actions in Workday will not trigger RTS, so scheduled imports are required to reconcile these actions. In fact, there are some RTS actions that are supported in Workday and some that are not.

Workday actions supported by real-time sync:

  • Worker hire, update, terminate, and re-hire triggers a RTS update to Okta.

  • Any updates to the standard Workday App User Base Profile attributes imported into Okta. With the exception of Manager Username, these actions trigger RTS.

  • Most changes to custom attributes trigger RTS.

  • Workday changes in Provisioning Group membership trigger updates to group membership in Okta.

Workday actions not supported by real-time sync:

Rescind actions do not trigger RTS.
  • The Manager Username attribute does not trigger RTS.

  • The addition of new provisioning groups does not trigger RTS.

  • Some changes to custom attributes may not trigger RTS.

  • RTS does not add pre-start hires into Okta.


RTS Behavior:

Okta performs a query to determine if any workers have been terminated in the last 24 hours, or will become terminated within the next 24 hours. Workers that fall into this category will have the following rules applied:
  • If the termination reason of the worker matches one of the configured immediate termination reasons within Okta, the worker is deactivated. Note that the termination date is not consulted if the termination reason matches. Thus a worker with an immediate termination reason that will become terminated within the next 24 hours will become terminated immediately on import/real time sync within Okta.
  • If the termination reasons are not matched, then the termination/last day worked date of the worker are compared to the current time. Okta relies on the timezone provided by Workday within the termination date when determining if the deactivation time has come to pass.
  • NOTE: Workday processes terminations at midnight PST. Thus customers in more Easterly time zones will see a delay of several or more hours until the worker is considered terminated by Workday.

The chart below illustrates various outcomes based upon termination variables:
 
Pre-hire interval set?Immediate termination reason matches?Use last day of work?Outcome
NNNWorker will become deactivated after their termination date has come to pass 
NNYWorker will become deactivated after their last day of work has come to pass
NYNWorker will become deactivated 1 day prior to their termination date coming to pass
NYYWorker will become deactivated 1 day prior to their termination date coming to pass
YNNWorker will become deactivated after their termination date has come to pass
YNYWorker will become deactivated after their last day of work has come to pass
YYNWorker will become deactivated after their termination date has come to pass
YYYWorker will become deactivated after their last day of work has come to pass
 

top

Prerequisites

top

Okta Setup

Setting a Termination Reason

What are the Immediate Termination Reasons?

By default, Okta waits until the end of the day to take actions on a terminated Worker in Workday. Such actions might include un-assigning them from the Workday app and/or deactivating them. However, if the termination reasons for the Worker match those specified in Immediate Termination Reasons and the termination date is set to the current date, Okta will take action immediately after receiving the event from Workday.

To do so, do the following:

  1. Under the Provisioning tab for the Workday app, edit the text input box “Immediate Termination Reasons” with the required termination sub category, as stated in Workday.
  2. Multiple values can be added with each separated by a pipe (|). Regex expressions are accepted.

Example: Terminate_Employee_Involuntary* would mean that all terminated Workers with that prefix in any of their Termination_Subcategory_ID(s) would be immediately unassigned from the Workday app and deactivated in Okta.

Also keep in mind that

  • There can be no default value for this text box.

  • Termination Reasons are selected in Workday under Reason and Secondary Reasons in Workday, as shown below.

         User-added image
  • Termination_Subcategory_ID(s) that identify each termination reason can be found by searching for the following in Workday: ‘Integration IDs’ then selecting the Business Object:‘Termination subcategory’.
User-added image

top

Workday Setup

Setup consists of the following:

A.    Creating an Integration System
B.    Adding Integration Attributes to the Integration System
C.    Adding Subscriptions to the Integration System
D.    Associate the Integration User to the Integration System
E.    Editing Business Process for adding the Integration System

A: Creating an Integration System

  1. Login into Workday as an admin.
  2. Type Create Integration System into the text input search box on the top left corner of the screen.
  3. Enter the values as shown below:
  • System Name: Name desired for the integration system

  • Select New using Template and select Okta-Worker from the list.

                    User-added image
  1. On the following screen, select Enable All Services and make sure that all check boxes under the Enabled column, are selected.

         User-added image
  1. After confirming the values, the page is directed to the Integration System page.

B: Adding Integration Attributes to the Integration System

  1. Click the related action button next to the Integration System (3-dotted button) as shown below and navigate to Integration system > Configure Integration Attributes.
          User-added image
  1. On the following screen, click on the (+) sign under Okta API Endpoint and Okta API Token to add a new entry and enter the following.
         User-added image

Okta API Endpoint

Use the bulleted elements in the following URL: https://<ENVIRONMENT>/api/v1/app/<Identity Provider ID>/activities.

  • Environment: Example: acme.okta.com, mycompany.okta.com

  • Identity Provider ID: From the View Setup Instructions link under the Sign On tab for the Workday app. See the screenshot below for the Number 7 value.

          User-added image

SAML Setup Page

User-added image

Obtaining the Okta API Token

  1. From the Okta Dashboard page, navigate to Security > API.
  2. Use the Create Token button to create token, then enter a relevant name for it.
  3. Copy the token and use it in the form detailed above.

C: Adding Subscriptions to the Integration System

  1. Click on related actions (3-dotted button) and navigate to Integration System > Edit Subscriptions, as shown below.  
User-added image
  1. Under Subscribe to specific Transaction Types, select items as per the types of events that are required. (Refer to Table 3 for specifications on the types of transactions).

  2. Click the () sign below External Endpoints to remove the configuration for External Endpoint.

           User-added image
  1. Click Add Launch Integration and add the values shown in Table 1 below:

          User-added image

 

 

Table 1

FieldValue TypesValue
WorkersDetermine Value at RuntimeTransaction Targets
As of Entry Moment  Determine Value at RuntimeTransaction Entry Moment
Effective DateDetermine Value at RuntimeTransaction Effective Moment
Note: If you receive an error, try inputting Transaction Targets as Workers instead of Transaction Targets.

D: Associate the Integration User to the Integration System.
This Integration System User should be created as instructed in the Workday Deployment Guide Version 4.1, which is also associated under Provisioning tab under the Workday app.
  1. Navigate to edit the Workday account, as shown below.

         User-added image

  1. On the next page, select the Integration System User under Workday Account and add it. This associates the Integration User to the System and completes the setup of the Integration System.

E: Editing Business Process for Adding the Integration System

  1. We will use Hire for this example. Refer to Table 3 for the appropriate business process type.

  2. Type in bp: hire in the Workday search box.

  3. Select Hire for <local org>. Example: Hire for Acme Inc. Do not select the default business process.

  4. Navigate to Edit Definition, as shown below.

         User-added image

We need to add a new step, which will be invoked after the hire process is complete. Find the order lettering which has the column set to complete as shown below. (In this example its set to a).

User-added image
  1. Click on the plus sign (+) to add a new step. (Located on the top left corner of the table).

  2. Set the Order value to b since we need the Business process to invoke real time sync after the completion step, which is set to a.

  3. Select type as Integration and click the OK button to save. This returns us to the Business process landing page.

  4. There will be a new Configure Integration System button. Click the button to start the configuration process.

        User-added image
  1. Select the Integration system that was created as per step A in the next screen, and then click the OK button.

On the following screen, add the values as shown in Table 2, shown below.

User-added image

Table 2

FieldValue TypesValue
WorkersDetermine Value at RuntimeWorker
As of Entry Moment  Determine Value at RuntimeDate and Time Completed
Effective DateDetermine Value at RuntimeEffective Date
 

This completes the steps for adding the Integration System event to the Business Process.

For the sync between Workday and Okta, refer to Table 3 below for the optimal combination of Business Process and Transaction Type.
 

Table 3

No.TypeNameEvent
1Business ProcessHireNew hire
2Business ProcessTerminationTermination
3Business ProcessJob ChangeJob, Supervisory org. Manager
4Business ProcessTitleJob Title Change
5Transaction TypeAccount Provisioning - Event Lite TypeWorkday ID change
6Transaction TypeContact Change - Contact InformationPhone number, email change
7Transaction TypeEdit Workday Account - Edit Workday Account Username, Employee ID change
8Transaction Type Legal Name Change - Legal Name Change Event Name change
9Transaction TypePerson Address Change - Event Lite Type Address change (Work Address)

Maintain Termination Categories in Workday

There are 2 ways to edit and/or view the categories for termination:

  • Search for maintain termination categories in the Search box and select termination for results.

  • Termination IDs via the integration IDs report: search for integration ids and then select the appropriate values, as shown in the two images below.

User-added image

User-added image