> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/q-z-integrations/workday-setup-for-workbench.md). # Workday Setup for Workbench This setup guide takes you through the necessary steps to set up your Workday integration. Having read-only access to Workday allows Expel to dig deeper during incident investigations and to research potential health issues. ## Prerequisites * You must have a Workday account with the following three security groups assigned: `System Administrator`, `System Auditor`, `Report Administrator`. ## Step 1: Create the Expel User and Group in Workday You must create a new user account and a new security group just for Expel. Doing this will keep Expel activity separate from all other activity happening in the Workday console. {% hint style="info" %} You must keep the Expel username and password on hand, as you will need it later in this guide. {% endhint %} 1. Log into the Workday device using your unique sign-in page. 2. Use the Search bar to navigate to **Create Integration System User**. 3. Fill in the Account Information: * **User Name** - enter "Expel\_user". * **Password** - create and verify a password; be sure to save this password to a safe place, as you will need it to configure the security device in Workbench. * **Session Timeout Minutes** - enter 0. * **Do Not Allow UI Sessions** - select this option. * Select **OK**. 4. Navigate to **Maintain Password Rules**, and then to **System Users exempt from password expiration**. * Add "Expel\_user" to this list. * Select **OK**. 5. Navigate to **Create Security Group**. * **Type of Tenanted Security Group** - select **Integration System Security Group (Unconstrained)**. * **Name** - enter "Expel Client Security Group". * Select **OK**. 6. Navigate to Edit Integration System Security Group (Unconstrained). * Add "Expel\_user" to this list. * Select **OK**. 7. Navigate to the **System Auditing** domain. 8. Open the **System Auditing Actions** menu. 9. Select **Domain > Edit Security Policy Permissions**. 10. Add the **Expel Client Security Group** to each of these tables: * **Report/Task Permissions** - select **View**. * **Integration Permissions** - select **Get**. 11. Select **OK**. 12. Navigate to **Activate Pending Security Policy Changes**. * Add a **comment** to describe what you have done. For example: "Created the Expel ISU and security group. Modified the system auditing domain to include Report/Task view permissions, Integration get permissions." * Select **OK** to activate the changes. ## Step 2: Generate the API Credentials Expel interacts with Workday through the API. To allow for the integration, you must generate a key, secret key, and refresh token. You must also copy and save the REST API endpoint and token endpoint. You will need all of these values during Workbench configuration ([Step 5](#step-5-add-workday-as-security-device-in-workbench)). 1. Navigate to **Register API Client for Integrations**. * **Client Name** - enter "Expel CollectorsCo". * **Non-Expiring Refresh Tokens** - select this option. * **Scope (Functional Areas)** - select **System**. * Select **OK**. 2. A new Client ID and Client Secret will be generated. Save these keys to a safe place, as you will need them to configure the integration in Workbench. {% hint style="info" %} If you lose the Client Secret, you can create a new one with Generate New API Client Secret. {% endhint %} 3. Select **Done**. 4. Navigate to **View API Clients**, and first validate that the ExpelCollectorsCo API client exists. 5. Next, copy and save the following two endpoints from the top of the screen, above the table, as you will need them to set up the security device in Workbench. *All endpoints must be set explicitly because of Workday's unique URL structure.* * **The Workday REST API endpoint** - example format:\ `https:///ccx/api/privacy/v1/)` * **The Token endpoint** - example format:\ `https:///ccx/oauth2//token`) 6. Navigate to the **API Clients for Integrations** tab. * Find the ExpelCollectorsCo client in the list and open the menu using the three dots. * Select **API Client > Manage Refresh Token for Integrations**. * In the Workday Account field, select **Expel\_user**. * Select **OK**. 7. On the **Delete or Regenerate Refresh Token** screen: * Select **Generate New Refresh Token**. * Select **OK** to generate the token. * Make a copy of the refresh token. Be sure to save it in a safe place, as you will need the token to configure the security device in Workbench. * Select **Done**. ## Step 3: Enable Activity Logging Activity logging enables all user activity to be recorded in a secure tenant database in Workday. Expel can then access this data via reporting. 1. Navigate to **Edit Tenant Setup - System** and select **Enable User Activity Logging**. 2. Select **OK**. 3. Navigate to **Edit Tenant Setup - Security**. 4. Under OAuth 2.0 settings, select **OAuth 2.0 Clients Enabled**. 5. Select **OK**. ## Step 4: Create a Custom Signon Report The signon report allows Expel to pull and ingest all data from the activity logging. 1. Navigate to **Copy Standard Report to Custom Report**. * From the Standard Report Name list, select **Candidate Signons and Attempted Signons**. * **Note:** If you do not see the "Candidate Signons and Attempted Signons" report, please refer to the [Troubleshooting](#troubleshooting) section. * Select **OK**. * Change the **Name** to "Custom Signons and Attempted Signons Report for Expel". * Select **Optimized for Performance**. * Select **OK**. 2. In the Data Source Filter field, select the **Workday System Accounts Signons in Range** filter. 3. Go to the **Columns** tab, and use the + button to add each of the following fields: * Operating System * Password Changed * Request Originator * SAML Identity Provider * Forgotten Password Reset Request * Multi-Factor Type * Is Device Managed * UI Client Type * Browser Type * Device is Trusted 4. In the **Column Heading Override** column, remove all text if any exists. 5. Select the **Advanced** tab. * Under Web Service Options, select **Enable As Web Service**. * Select **OK**. 6. Open the **Share** tab. * Select **Share with specific authorized groups and users**. * In the **Authorized Users** group, add the Expel\_user. * Select **OK**. 7. Select **Done** to save the custom report settings. 8. In the search bar, search for **Custom Signons and Attempted Signons Report for Expel** and select **OK** to run the report. * Open the Actions menu and select **Web Service > View URLs**. * Select **OK**. * Find the JSON area and right click on the three dots, then select **Copy URL**. 9. Paste the URL somewhere you can edit it, like a text editor. * Remove all query parameters from the URL. * Update the URL to include the Expel user and report name, so that it looks like this:\ `https:///ccx/service/customreport2//Expel_user/Custom_Signons_and_Attempted_Signons_Report_for_Expel_New` * If you used a different user to create the report, specify that user (the Report Owner) in place of "Expel\_user" in the URL above. * Save this URL in a safe place as your signon report endpoint, which you will need in the next section. ## Step 5: Add Workday as Security Device in Workbench Now that you have the correct access configured and noted the credentials, you can configure the integration in Workbench. 1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F). 2. In the side menu, navigate to **Organization Settings > Security Devices**. 3. Select the **Add Security Device** button. 4. In the search box, type “Workday” and then select the Workday integration. 5. Complete the fields as follows: * **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Workday”; this name will display in Workbench under the Name column, and is a text string that you can filter on. * **Location** - enter the location of your integration, for example “cloud;” this is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations. * **Client ID** - enter the API Client ID from Step 2. * **Client Secret** - enter the API Client Secret from Step 2. * **Refresh Token** - enter the Refresh Token from Step 2. * **Rest API Endpoint** - enter the REST API endpoint from Step 2. * **Token Endpoint** - enter the token endpoint from Step 2. * **Sign on report endpoint** - enter the signon report endpoint from Step 4. * **Sign on report username** - enter "Expel\_user". * **Sign on report password** - enter the password you created for Expel\_user in Step 1. 6. Select **Save**. Your device should be created successfully within a few seconds. A few reminders: * After your connection is healthy, it will take some time for your device to begin polling and receiving data. * To check on the status, select the downward arrow for your device in the first column and choose **View details**. * Polling will happen first; data will be received after that. **You must refresh the page to see updates.** * If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, [contact our support team for help](/support/how-to-reach-us.md). * To check if alerts are coming through, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning). ## Troubleshooting **If you do not see the "Candidate Signons and Attempted Signons" report available in Workday:** * Ensure you are logged into a Workday account with the **System Administrator**, **System Auditor**, and **Report Administrator** security groups assigned. * If you have not purchased the Recruiting Functional Area module, the standard Candidate Signon report may not be available. The alternative is to create a new custom report with **Data Source = "All System Account Signons"** and **Data Source Filter = "Workday System Account Signons in Range"**. You can validate the columns and fields required when generating the report by referencing the CSV file provided below. After you've created the new report, resume [Step 4](#step-4-create-a-custom-signon-report) and choose the new report you created as your template. {% file src="/files/jBRCsSjv8MnxOUsdUhou" %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/connect-your-technology/q-z-integrations/workday-setup-for-workbench.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.