Incydr Flow: Workday

Overview

This article explains how to configure the Incydr Flow for Workday, which automates Incydr watchlist management. Specifically, the Workday Flow:

• Automatically adds users to Incydr's Departing Employee watchlist based on their departure date in Workday.
• (Optional) Automatically adds users to Incydr's New Hire watchlist based on their start date in Workday.

The steps below cover how to create a report in Workday, create an Incydr API client, and define the required properties in the Incydr console.

Considerations

• You must be licensed for the Workday Flow to complete the steps below. Contact your Customer Success Manager (CSM) if you have questions about licensing.

Step 1: Workday configuration

Work with your Workday administrator to complete the steps below for departing and new hire employees.

Departing employees

1. Create an Integration System User (ISU). See Workday's support documentation for more details.
   To ensure uninterrupted service, consider setting the password to never expire. Alternatively, if password rotation is a requirement, you will need to coordinate with your Workday administrator each time the password expires to update the Incydr configuration with the new password.
2. Save the username and password in a secure location for future reference.
   The ISU credentials are required to initially enable the Flow in the Incydr console, as well as to update settings after the initial setup.
3. Ensure the ISU account has access to the user's email address, departure date, and start date report fields.
   • Note: The user's email address in Workday must match the Incydr username.
4. Create a Workday report filtered to show departing users. For example, users with departure dates in the next 45 days.
5. Use the Column heading override xml alias to update the report column headings:
   • For the user's email address, set the alias to username
   • For the departure date, set the alias to dep_date
     • Use the date format: YYYY-MM-DD.
6. Configure the report to dynamically update as users fall in and out of scope.
   • Include employees who have upcoming departure dates within a set time frame. For example, within the next 45 days.
   • Remove employees if their departure date has passed.
7. Obtain the Workday report URL (formatted in “simpleXML”).
   The report URL is required in the steps below to enable the Flow in the Incydr console.

New hire employees (optional)

To automatically add users to Incydr's New Hire watchlist:

1. Create a separate Workday report filtered to show the new hires. For example, users with start dates in the past 90 days.
2. Use the Column heading override xml alias to update the report column headings:
   • For the user's email address, set the alias to username
   • For the start date, set the alias to start_date
3. Configure the report to dynamically update as users fall in and out of scope.
   • Include employees who have start dates within a set time frame. For example, the past 90 days.
   • Remove employees once their start is more than 90 days ago.
4. Obtain the Workday report URL (formatted in “simpleXML”).
   The report URL is required in the steps below to enable the Flow in the Incydr console.

Step 2: Incydr configuration

API client setup

Create a new Incydr API client:

1. Sign in to the Incydr console.
2. Go to Administration > Integrations > API Clients.
3. Select Create new API client.
4. Enter a name specific to this flow (for example, "Workday departing employee").
5. Add these permissions:
   • Detection lists - Read and Write
   • User - Read
6. Save the Client ID, Secret, and Base URL in a secure location for future reference.
   The Incydr API client credentials are required to initially enable the Flow in the Incydr console, as well as to update settings after the initial setup.

Workday Flow setup

1. In the Incydr console, go to Administration > Integrations > Incydr Flows.
2. From the list of Flows, select the Workday watchlist management flow.
3. Complete these fields:
   • Workday ISU username: Enter the username of the Integration System User you created above in step 1.
   • Workday ISU password: Enter the password of the Integration System User you created above in step 1.
   • Departing Employee - Workday report URL: Enter the report URL for the departing employee report you created above in step 1.
   • New Hire - Workday report URL: (Optional) Enter the report URL for the new hire report you created above in step 1.
   • Incydr API client ID: Enter the Incydr API Client ID obtained in step 2 above.
   • Incydr API client secret: Enter the Incydr API Secret obtained in step 2 above.
   • Incydr base URL: Enter the Base URL obtained in step 2 above. You can also obtain the Base URL by identifying the URL for your Incydr cloud environment.
   • Recipient email address for error report: Specify an email address to receive reports when a Workday user does not have a matching user in Incydr. Reports are sent once per the scheduled interval defined below.
   • Scheduled interval in minutes: Select how often to run the Flow and process changes.
4. Click Submit.

Related topics

• Introduction to Incydr Flows
• Configure Incydr Flows
• External: Workday documentation