xtb9q (xtb9q) asked a question.
Similar question was already posted on forum earlier, however no resolution was mentioned on this: https://support.okta.com/help/s/question/0D54z000080rqCJCAY/workday-filter-on-users-to-be-imported?language=en_US
We have Workday > Okta integration to create users in Okta. The Workday tenant contains more than 10k users but we only want few users in Okta to test identity lifecycle based workflows. We want to achieve this based on a specific filter (probably based on value of Supervisory Org). We did not find anything in the standard workday connector offered by Okta. Is there any solution on this to be implemented from Okta side?
We have tried this also on Workday side for filter : placing the workday API user in a Constrained Security Group, which can only be constrained by Org Assignment. However, when we implement this on Workday side it is throwing error on Okta side during user import as:
Unable to fetch Workday users: The data you are trying to fetch is outside of your Constrained Security Group: Validation error occurred. The entered information does not meet the restrictions defined for this field. (Worker_Reference)
This restriction is set at workday level, however Okta is trying to pull all user data from workday and that is why it is throwing error. We cannot customize anything on Okta side for this. Is there anyway we can put this restriction at Webservice endpoint URL level with query parameter, so that even if this user API_User has permission, it will not read everything there is on Workday side.
Is there any possible solution on this?
Hi @xtb9q (xtb9q) , Thank you for reaching out to the Okta Community!
An issue pertaining to Security Group constrains was discussed here as well.
It's not exactly your use case but check it out to see it helps in any way.
If my answers helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
Watch and Learn: New Okta how-to videos, plus what's new this month in the May newsletter.
Hi @xtb9q (xtb9q) ul, We have got the same issue. Currently working on importing only users that have their email with our domains, which has been assigned couple of custom fields in workday (Business Area or Job Profile).
We were trying to use the Workday Field overrrides but still figuring out how to use it to filter the users in the import.
@Mihai N. (Okta, Inc.) Any advise?
Hi @HomerB.80641 (Customer).
If you are dealing with the Security Groups as well, then there's not much insight I can provide besides what has already been covered in the previous posts.
That being said, I would recommend that you open a case so one of our Support Engineers can have a look at your specific implementation, perhaps they have something to add.
Hello,
When we worked with Okta support team, there is no way to filter data anyway at connector level. However, all new users that would come through Workday to Okta, can be routed through "Import inline hook" where you can only process those users required, based on some logical condition of attribute value. In this case also, all Workday users will be processed - we cannot avoid them being added on Import queue on okta for workday application (you have to restrict match and user creation manually).
At this time, there is no way users can be filtered out completely, which are coming through Workday connector in Okta.
Hi @xtb9q (xtb9q)
Thank you for your insights.
How did you get the Workday email attribute populated in the "import queue"?
we are just getting the name and username (employee ID) but not the email, which seems an okta requirement to complete the assignment.