How to convert from contractor to full-time employee using Workday Provisioning.
Please note that upon converting the user from Contractor to Full Employee, the user will be reassigned to all Okta applications, which may generate deprovisioning and reprovisioning tasks. The conversion process involves deactivating and reactivating the Okta user and replacing the data with the newly imported data from Workday.
- Workday
- Provisioning
- Full-Time Employee
- Contractor
To ensure a smooth deployment, a Professional Services engagement is required for using Workday as a Profile Master.
On the Workday side, the Contractor and Full-Time workers are separate entities with two separate Workday IDs. Universal ID configuration links these together by setting the same secondary ID for both (Universal ID).
To use Workday Contractor to Full-Time Employee conversion support, the Workday tenant setup must be modified to configure Universal ID for workers first. Once configured, Universal ID only applies to newly created tenants' workers. The Workday profiles must be manually updated using Workday's API to backport them to existing workers. Without a Universal ID, Okta cannot detect when a contractor has been converted to full-time, which may result in duplicate workers in some cases.
Mapping Universal ID from Workday to Okta is optional and is not required for this feature to work.
Why is Universal ID needed?
If the Workday Provisioning integration is configured with a pre-hire interval but Universal ID is not configured, Okta will pull in the Contractor worker. While fetching pre-hires, the future Full-Time user (pre-hire) will also be pulled in. As a result, Okta will create a duplicate entry in the Import tab. This happens because those two workers in Workday have different Workday IDs, and Okta cannot detect that they are the same user.
On the Workday side, the Contractor and Full-Time workers are separate entities with two separate Workday IDs. Universal ID configuration links these together by setting the same secondary ID for both (Universal ID).
How does it work?
When Universal ID is configured in Workday as part of the Contractor to Full-Time conversion feature, Okta detects if any workers are coming in as pre-hires with the same Universal ID as the currently active and existing workers. If there are such pre-hires, we filter them out while the currently existing workers with the same Universal ID are present.
When the Contractor worker is deactivated, and the import from Workday is running, a Full-Time user will be selected, as the Contractor is no longer an option.
Upon conversion, the Okta user is deactivated and then reactivated. This is expected behavior; from Okta’s perspective, the Contractor worker is terminated, and a new Full-Time worker is hired.
This was implemented to support cases when a Contractor worker is terminated, but the hire date of the Full-Time user is not the same day.
For example, a Contractor was converted to Full-Time, but they wanted to take a week off before the start date as a Full-Time worker. The Full-Time worker will not be imported until their actual start date.
For the conversion to work automatically, this is the minimum set of configuration options on the Provisioning To Okta tab, as follows:
For User Creation & Matching:
-
Auto-confirm exact matches
-
Auto-confirm new users
For Profile & Lifecycle Sourcing:
-
Reactivate suspended Okta users (optional, depends on the setup)
-
Reactivate a deactivated Okta user
There might be a gap between Contractor user deactivation and Full-Time user reactivation. This is usually caused by a time zone difference between a user’s termination/hire dates in Workday and the time zone the Workday tenant operates in. Currently, Okta supports only Time Zone-Aware terminations but does not consider the time zone when importing new hires.
Learn how to configure Universal ID for a Workday tenant by referring to the following articles (a Workday Community account is needed to access them).
