Workday Real Time Sync

Workday Real Time Sync (RTS) allows Okta to receive user creation, update, and termination events from Workday on a real-time basis. User changes in Workday are reflected immediately in Okta and its downstream applications.

RTS is used to trigger an update from Workday to Okta in real time. It should be used for changes where timeliness is critical such as immediate termination of a worker. A business process must be configured in Workday to send the trigger to Okta to start this process. Included in the RTS import are base attributes, non-future, and future effective dated custom attributes.

It is highly recommended that RTS be used in combination with scheduled imports that are run on a 1-2 day interval. This is because some less frequent actions in Workday will not trigger RTS, so scheduled imports are required to reconcile these actions.

Prerequisites

Workday is set up as the Profile Source. For instructions, see Workday.

Features

Workday actions not supported by Real Time Sync:

Updates to the Second Email attribute do not trigger RTS.
Updates to the Manager Username attribute do not trigger RTS.

Some of the worker attributes, like the Manager Username, cannot be populated in Okta as part of Real-Time Sync. The workaround is to have the attribute added to Workday field overrides or to Custom Report (deprecated) configuration.

The table displays what does and does not require an update in base attributes to trigger RTS:

Features	Requires base attribute update to trigger RTS (SAMPLE base attributes- firstName, lastName, email)
Create New user	No
Update User Base Attribute	No
Terminate User	No
Update Users Custom Attribute	Yes
Create New Group	Yes
Update Group Name & Description	Yes (Not recommended. See Manage Workday Provisioning Groups)
Update Any Group Settings	Yes
Add New User To Group	No
Update User Base Attribute in Group	Yes
Remove User From Group	Yes

List of Base Attributes

Display Name	Variable Name	Type
User Name	userName	String
First Name	firstName	String
Last Name	lastName	String
Email	email	String
Second Email	secondEmail	String
Mobile Phone	mobilePhone	String
Employee ID	employeeID	String
Worker Type	accountType	String
Title	businessTitle	String
Manager ID	managerId	String
Manager Username	managerUserName	String
Street Address	streetAddress	String
City	city	String
State	state	String
Postal Code	postalCode	String
Country (ISO-3166)	countryCode	String
Supervisory Organization	supervisoryOrd	String
Business Unit	businessUnit	String
Work Phone	workPhone	String
Location	location	String

RTS Deactivation

RTS follows the same deactivation rules when querying the user in real time. Information about deactivation can be found under Deactivation.
Users can be deactivated immediately upon sync if the immediate deactivation reasoning has been set up. See Immediate Deactivation Reasons.
Group name change is not recommended in conjunction with RTS. See Manage Workday Provisioning Groups.

Procedures

Workday configuration

Step 1: Create an Integration System
Step 2: Add Integration Attributes to the Integration System
Step 3: Add Subscriptions to the Integration System
Step 4: Associate the Integration User to the Integration System
Step 5: Edit Business Process for adding the Integration System

Step 1: Create an Integration System

Sign in to Workday as an administrator.
Type Create Integration System in the search box on the top left corner of the screen.
Enter the following information:

System Name: Name desired for the integration system
Template: Select New using Template, then select  Okta-Worker from the list.
Click OK.

Select Enable All Services and make sure that all checkboxes under the Enabled column are selected.

You may see the following error. You can ignore it because you finish the configuration in the next section.

After confirming the values, the Integration System page opens.

Step 2: Add Integration Attributes to the Integration System

Click Actions adjacent to the Integration System, then go to Integration System > Configure Integration Attributes:
Click the plus (+) sign for the Okta API Endpoint and Okta API Token to add a new entry for each attribute.

Okta API Endpoint

In the URL: https://<ENVIRONMENT>/api/v1/app/<Identity Provider ID>/activities/, use these elements:

Environment: Example: acme.okta.com, mycompany.okta.com
Identity Provider ID: From the View Setup Instructions link under the Sign On tab for the Workday app. Use the value generated for Issuer in the Setup Instructions.

To obtain the Okta API Token, follow these steps:

Create an Okta service account.
Make the service account an Application Administrator of the Workday application.
Sign in to Okta as this user.
From the Okta Dashboard page, go to Security > API.
Click  Create Token, then enter a relevant name for it.
Copy the token and use it in the form detailed above.

Step 3: Add Subscriptions to the Integration System

Click the ellipsis (three dots) adjacent to the Integration System, then go to Integration System > Edit Subscriptions.
Under Subscribe to specific Transaction Types, select items as per the types of events that are required. (Refer to Table 3  for specifications on the types of transactions).
Click the minus (–) sign below External Endpoints to remove the configuration for External Endpoint.
Click Add Launch Integration, then add the values shown in Table 1:
You may see the following alert. You can ignore it as it will be fixed in the next section.

Table 1:

Field	Value Types	Value
Workers	Determine Value at Runtime	Transaction Targets
As of Entry Moment	Determine Value at Runtime	Transaction Entry Moment
Effective Data	Determine Value at Runtime	Transaction Entry Moment

Note: If you receive an error, try inputting Transaction Targets as Workers instead of Transaction Targets.

Step 4: Associate the Integration User to the Integration System

This Integration System User should be created as described in Create an Integration System User in Workday.

Click the ellipsis (three dots) adjacent to the Integration System, then edit the Workday account.
Select the Integration System User under Workday Account and add it. This associates the Integration User to the System and completes the setup of the Integration System.

Step 5: Edit Business Process for adding the Integration System

We use Hire in this example. For the appropriate business process type, see Table 3 .
Enter bp: hire in the Workday search box.
Select Hire for <tenant>. For example: Hire for Acme Inc. Do not select the default business process.
Go to Edit Definition.
We need to add a new step, which will be invoked after the hire process is complete. Find the letter in the Order column matching the Yes in the Complete column. (In this example it's set to a).
Click the plus sign (+) to add a new step.
Set the Order value to b since we need the Business Process to invoke real time sync after the completion step, which is set to a.
Select the type as Integration, then click OK to save. You return to the Business process landing page.
You may see the following error. You can ignore it because it will be fixed in the next section.
There is now a new Configure Integration System button. Click this to start the configuration process.
Select the Integration system that was previously created, then click OK.
Add the values as shown in Table 1:

Table 2

Field	Value Types	Value
Workers	Determine Value at Runtime	Worker
As of Entry Moment	Determine Value at Runtime	Date and Time Completed
Effective Date	Determine Value at Runtime	Effective Date

This completes the steps for adding the Integration System event to the Business Process. For the sync between Workday and Okta, see  Table 3  for the optimal combination of Business Process and Transaction Type.

Table 3

No.	Type	Name	Event
1	Business Process	Hire	New hire
2	Business Process	Termination	Termination
3	Business Process	Job Change	Job, Supervisory org. Manager
4	Business Process	Title	Job Title Change
5	Transaction Type	Account Provisioning - Event Lite Type	Workday ID change
6	Transaction Type	Contact Change - Contact Information	Phone number, email change
7	Transaction Type	Edit Workday Account - Edit Workday Account	Username, Employee ID change
8	Transaction Type	Legal Name Change - Legal Name Change Event	Name change
9	Transaction Type	Person Address Change - Event Lite Type	Address change (Work Address)

Maintain Termination Categories in Workday

There are two ways to edit or view the categories for termination:

Search for maintain termination categories in the search box and select termination for results.
Termination IDs via the integration IDs report: search for integration IDs and then select the appropriate values.

Pre-hire interval set?	Immediate deactivation reason matches?	Use last day of work?	Outcome
No	No	No	Worker will become deactivated after theirtermination date has come to pass
No	No	Yes	Worker will become deactivated after theirlast day of work has come to pass
No	Yes	No	Worker will become deactivated 1 day priorto their termination date coming to pass
No	Yes	Yes	Worker will become deactivated 1 day priorto their termination date coming to pass
Yes	No	No	Worker will become deactivated after theirtermination date has come to pass
Yes	No	Yes	Worker will become deactivated after theirlast day of work has come to pass
Yes	Yes	No	Worker will become deactivated after theirtermination date has come to pass
Yes	Yes	Yes	Worker will become deactivated after theirlast day of work has come to pass

Workday Real Time Sync | Okta (2024)