Set Up the Workday Integration

Overview

As the person managing this integration, whether you're an IT Admin, Procurement Manager, or from another relevant team, ensure you have the necessary permissions and a thorough understanding of both systems. You may also assign an Integration Manager to oversee the process. If there are any issues during setup, the Integration Manager and Tropic account admin will be notified.

Overview of Tropic's Integration with Workday

Tropic’s integration with Workday is a one-way integration that serves as the source of truth for employee and Department-level data. This integration automatically keeps user and department information up to date with your Workday records by creating user profiles, assigning department names, and associating each user with their direct manager. When you update information in Workday, it automatically reflects in Tropic.

Steps to Connect Tropic & Workday

• Establish a Connection User in Workday: Begin by creating a connection user in Workday. You'll use this user's credentials to establish the connection between Workday and Tropic.

• Use Connection Details to Link Workday & Tropic: After establishing the connection user in Workday, use those details to connect Workday with Tropic.

Enable Required Functional Areas in Workday

Ensure the following Workday functional areas are enabled for the integration to work properly:

• Personal Data
• Contact Information
• Staffing

To enable these functional areas:

1. Log in to the Workday application.
2. Search for the Maintain Functional Areas task.
3. Select the checkboxes Enabled, Personal Data, Contact Information, and Staffing.
4. Click OK, then click Done.

Create an Integration Systems User in Workday

To create the integration user in Workday and assign them the appropriate role and permissions:

• Create an Integration System User (ISU):
  • In your Workday portal, search for Create Integration System User.
  • Enter a username and password, then click OK.
  • Important: Do not use "&", "<", or ">" characters in the password.
  • To prevent the password from expiring, search for Maintain Password Rules and add the ISU to the Exempt from Password Expiration list.
• Create a Security Group and Assign the ISU:
  • Search for Create Security Group.
  • Select Integration System Security Group (Unconstrained) from the dropdown.
  • Enter a name, and in the Integration System Users field, enter the ISU username.
  • Click OK.
• Configure Domain Security Policy Permissions:
  • Search for Maintain Permissions.
  • Ensure the operation is set to Maintain, and select the security group created earlier.
  • Add the required Domain Security Policies. (See detailed instructions with screenshots if needed).
• Activate Pending Security Policy Changes:
  
  • Search for Activate Pending Security Policy Changes.
  • Review the changes, add comments, and confirm by clicking OK.
• Validate Authentication Policy:
  • Search for Manage Authentication Policies.
  • Edit the existing policy or create a new one, ensuring the allowed authentication type is User Name Password or Any.
• Activate Pending Authentication Policy Changes:
  • Search for Activate All Pending Authentication Policy Changes.
  • Confirm and save the changes.
• Obtain the Web Services Endpoint URL:
  • Search for Public Web Services.
  • Open the report, click on Web Services, then View WSDL.
  • Copy the URL and enter it into the linking flow.

For complete, step-by-step instructions, including screenshots, please refer to Workday - How do I link my account?.

Connect Workdays to Tropic

Requires the following role: Owner

• To access the integration, go to the Integration page, select checkbox HRIS under Data Categories. Then, click View Details.

• Alternatively, you can click the 'Setup Integration' link in the email you received when you were assigned this step.

• Click Connect and select the way you want to connect.
  • We do recommend using your credentials

• Click I am an Admin (make sure you are or you won't be able to continue to install Workday!) 
• Review your permissions and click Next
• Provide your USER ID and PASSWORD and click Next (a few times) where all the steps are laid down for you again. 
• Paste in the Workday URL from above and click Submit.

Note: It might take a few minutes and your integration will be syncing. You can take a look in your Integration page!

Once connected, the Workday integration will import and process your user and Department data overnight. Once this is complete, all Departments present in Workday will be added in Tropic. All employees present in Workday will also have been imported into Tropic and mapped to their corresponding Department record in Tropic. Further finishing steps are required to round out the integration setup process.

Update User Roles

By default, all new users that are imported from Workday will be assigned the Portal User role. If the user will need access to the Tropic Platform, their role will need to be updated to one of the four platform roles; Owner, Platform Member, Department Admin, and Department Member. See User roles and permissions.

Please refer to changing a role to a user documentation to update a role. 

Send User Invitations

By default, all employees pulled in from Workday will be assigned the status Awaiting Invitation. In this status, a user can be assigned to Tasks or made a Contract Owner but they will not receive any communication from the Tropic platform (including Task notifications) until they are sent an invitation.

It is crucial that employees who will be proactively assigned as Contract Owners or as reviewers/approvers in your organization’s procurement Workflows are sent invitations so that they will receive notifications when action is required of them. Employees who are not actively part of the procurement Workflows or who do not act as Contract Owners do not need to be proactively invited and will be able to self-activate when they need to submit a Request or otherwise access the Portal.

Inviting Users Individually

Navigate to Settings --> Users Awaiting Invitation then (1) click the checkbox of the user you wish to invite then (2) select Send Invite.

Bulk Users Invite 

Navigate to Settings > Users > Awaiting Invitation then select Bulk send email invitations. This will send an invitation to all users. 

Please note that once an invitation is sent to a user, all platform notifications will be delivered regardless of whether the user completes the activation of their account. 

De-duplicate Departments

When Tropic connects with Workday it will create a corresponding Department in Tropic for every Department in Workday. If you have already created a Department in Tropic and the name matches exactly with the Department in Workday, then the existing Department will be linked to the Department in Workday. If the name is not an exact match, a duplicate Department will be created.You will want to review the list of Departments and archive any duplicates. To do so, go to Settings > Departments and follow the steps below:

1. Using the search function, search the names of the Departments you originally created. 
2. Check for alternatives pulled in from Workday
3. If the Department is now replaced by a Department(s) imported from Workday, archive the original Department by selecting the checkbox and Archive.

Disconnect the Workday Integration

To disconnect the Workday integration from Tropic navigate to Settings > Integrations > Workday > Disconnect. 

FAQs

Connection and sync

A: Will adding an Integration Systems User have any cost to us or use up a user license with Workday?

Q: There should be no additional cost for adding this Integration Systems User in Workday.

A: Can I connect Workday and another HRIS system to Tropic simultaneously? 

Q: Currently, only 1 HRIS system can be connected to Tropic at any given time.

A: Will any changes I make in Tropic update in Workday?

Q: No, this integration is a one-way integration and only pulls in data from Workday. No data is published back to Workday. 

 What are the minimum possible permissions for this integration?

Q: The minimum permissions for this integration are the following:

• Worker data: Worker
• Worker Data: Public Worker Reports
• Worker Data: Current Staffing Information
  

Users

A: Why can’t I edit any fields for a user besides their Role? 

Q: When users are imported from Workday, all fields that are imported are locked to ensure there is no divergence from Workday. This maintains one source of truth. The Role field is unique to Tropic and so can be edited at any time. 

A: Will this integration support individual users who may have more than one email address in Workday?

Q: No. In cases where a single user has more than one email, the Workday admin will need to create a separate, unique email address for the end user and then attempt to resync.

A: If an individual has different email addresses in Workday & Tropic, will Tropic handle the reconciliation or de-duplication between those email addresses?

Q: No, Tropic uses the email address as the unique identifier to map users. 

A: What happens if a user’s email already exists in Tropic and the HRIS is synced? Does it override their details i.e. Department or does it create a duplicate? 

Q: If a user exists, and is in the same organization, Tropic will update all of the data except Role. We cannot create duplicated users because we use email as a unique identifier. 

A: When the user is deactivated in the HRIS, they'll also be deactivated in Tropic. How will this impact employee pages & utilization data? Will you still see the user's employee page? Will there be any indication they’re deactivated? Will the user still appear in usage data?

Q: Users will show as deactivated in Tropic (see below). The employee page will rely on the user’s presence in the SSO integration feeding into that feature (usually Okta). The utilization is tied to their actual utilization so will halt when they stop using tools but will not be automatically removed from the record when they are deactivated in Workday.

A: Will all users who don’t currently have a role in Tropic be assigned portal users by default? 

Q: Yes, all net new users from the HRIS system will be assigned a Tropic user account created with a Portal user as their default role. 

Departments

A: What field is used to determine a user's department when syncing data from Workday into Tropic?

Q: The value in the field 'Cost Center' associated with each employee in Workday will be applied as the user's Department in Tropic.

A: If a Department already exists and the same one exists in Workday, will it be overridden in Tropic or will a new Department with the same name be created?

Q: If you have already created a Department in Tropic and the name matches exactly with the Department in Workday, then the existing Department will be linked to the Department in Workday and no new record will be created.

A: If a Department is deleted in Workday, what happens in Tropic?

Q: The corresponding Department in Tropic will be archived.

Additional Resources

Please visit our Help Center for more documentation