Set Up a Workday ISU for SmartResearch (New Customers)

Introduction

This guide explains how to configure your Workday connection for Auditoria SmartResearch: set up a dedicated Integration System User (ISU), create a security group, and grant the permissions needed to access the required Workday data sources.

This article covers both the accounts payable (AP) and the accounts receivable (AR) data that SmartResearch uses. It is for organizations connecting Workday to Auditoria for the first time, for SmartResearch. If your organization already connects Workday to Auditoria for SmartVendor or SmartCustomer, use the article for your setup instead: Add SmartResearch to a SmartVendor ISU, Add SmartResearch to a SmartCustomer ISU or Add SmartResearch to a SmartVendor and SmartCustomer ISU. If you use only other Auditoria products with Workday, follow this article.

If you have questions during the setup, contact your Workday administrator or your Auditoria support representative.

Prerequisites

Before you begin, have the following in place:

• Workday administrative access: You must have administrator privileges in your Workday tenant to create users, security groups, and assign security permissions.

• Auditoria SmartResearch licensing: Confirm that your organization has an active Auditoria SmartResearch subscription.

• Workday Integration System User setup permissions: Ability to create and configure an Integration System User (ISU) in Workday.

• Permission to create and manage security groups: Authorization to create security groups and assign domain security policies in Workday.

• API client registration privileges: Access to register and manage API clients for integrations in Workday.

• Coordination with your IT and Workday teams: Tell all stakeholders involved in Workday integration and data security about this setup process.

If you do not have these permissions, contact your Workday administrator or your internal IT team for assistance.

Set up Workday for SmartResearch

1. Get your Workday hostname and tenant name

To configure the connection between Auditoria SmartResearch and Workday, you will need your Workday hostname and tenant name. Follow the steps below to locate this information:

1. Log in to your Workday console using your administrator credentials.

2. Search for “Public Web Services” in the search bar at the top of the Workday screen.

3. In the search results, select the Public Web Services report.

4. In the report, locate the Web Service column and apply a filter to display only Revenue Management (Public).

5. Locate Revenue Management (Public) in the list. Select the three dots (…) next to it, and then select Web Service > View WSDL.

6. In the WSDL file, search for the text "Revenue_Management". Scroll to the last occurrence to find the hostname and tenant name.

   • The hostname will appear in the URL, such as:

     https://wd2-impl-services1.workday.com/ccx/service/your-tenant-name/Revenue_Management/v48.0

   • The tenant name will appear in the URL path, following the domain and “service/”.

7. Copy both the hostname and tenant name. You will need to enter these values during the Auditoria SmartResearch connection setup process.

Figure 1. The Public Web Services report in the search results

Figure 2. The Web Service filter set to Revenue Management (Public)

Figure 3. The View WSDL option for Revenue Management (Public)

2. Create the Workday Integration System User (ISU) for Auditoria SmartResearch

To enable secure integration with Auditoria SmartResearch, you must create a dedicated Integration System User (ISU) in Workday. Follow these steps:

1. Log in to your Workday console using an account with administrative privileges.

2. Search for “Create Integration System User” in the search bar.

3. Select Create Integration System User from the search results.

4. Enter a clear and descriptive User Name for the new ISU, such as ISU_Auditoria_SmartResearch.

5. Set a new password for the ISU in New Password, and enter it again in New Password Verify. Make a note of this password, as it will be required during the integration setup.

6. Leave Require New Password at Next Sign In cleared.

7. Don’t select Generate Random Password. Workday accepts it only for a user with a primary work email.

8. Review and confirm the details, then select OK to create the user.

Figure 4. Create Integration System User in the search results

Figure 5. The Create Integration System User form

Important:

• Use a unique ISU for Auditoria SmartResearch. Don’t reuse an ISU intended for another integration.

• Securely store the username and password in accordance with your organization’s IT security policies.

• You will assign this ISU to the appropriate security group in the next step.

3. Create a Workday security group and assign the ISU

You need to create a Workday security group and assign the Integration System User (ISU) you created for Auditoria SmartResearch. This allows you to manage permissions centrally and securely.

To create a security group and assign your ISU:

1. Log in to your Workday console using an account with administrative privileges.

2. Search for “Create Security Group” in the search bar.

3. In the search results, select Create Security Group.

4. In the Type of Tenanted Security Group drop-down, select Integration System Security Group (Unconstrained).

5. In the Name field, enter a descriptive name (for example, ISSG_Auditoria_SmartResearch).

6. Select OK. The new security group will be created.

7. On the Edit Integration System Security Group (Unconstrained) page, locate the Integration System Users section.

8. Add the ISU you created in the previous step (for example, ISU_Auditoria_SmartResearch).

9. Select OK to save the assignment.

Figure 6. Create Security Group in the search results

Figure 7. The Create Security Group form

Figure 8. The security group with the ISU in Integration System Users

Note:

• Use a unique security group for Auditoria SmartResearch; do not assign unrelated users.

• You will assign the required domain security policies to this group in the next step.

4. Assign domain security policy permissions for SmartResearch data sources

To enable Auditoria SmartResearch to access the required data from your Workday tenant, you must assign the correct domain security policy permissions to the integration security group you created.

1. Log in to your Workday console with administrative privileges.

2. In the Workday search bar, type "Security group" and select View Security Group from the search results.

3. In the prompt, enter the name of your group (for example, ISSG_Auditoria_SmartResearch).

4. Select OK.

5. On the Integration System Security Group (Unconstrained) overview page, select the Related Actions (three dots menu) next to the group name.

6. Select Security Group > Maintain Domain Permissions for Security Group.

7. If an Errors & Warnings grid opens before the form, select OK to continue.

8. In the Report/Task Permissions and Integration Permissions sections, add the required Domain Security Policies for each SmartResearch data source, using the operation/access level provided in the tables below. Use Modify, View, Get, or Put access level as specified.

   The Operation value in each table row tells you which fields to add the policy to:

   • View Only: Domain Security Policies permitting View access.

   • View and Modify: Domain Security Policies permitting View access and Domain Security Policies permitting Modify access.

   • Get Only: Domain Security Policies permitting Get access.

   • Get and Put: Domain Security Policies permitting Get access and Domain Security Policies permitting Put access.

9. Select OK to save your changes.

Figure 9. View Security Group in the search results

Figure 10. The View Security Group prompt

Figure 11. The Maintain Domain Permissions for Security Group action

Figure 12. The four permission fields on the Maintain Domain Permissions form

Add the permissions in both tables. Table 1 covers AP data and Table 2 covers AR data. Policies that both need, such as Set Up: Accounts, appear only in Table 1.

Table 1. Workday Domain Security Policy Permissions Matrix (AP)

Table 2. Workday Domain Security Policy Permissions Matrix (AR)

If you have questions about specific domain security policies or data source configurations, consult your Workday administrator or Auditoria support representative.

5. Activate pending security policy changes

Important: Selecting OK activates every change in the Domain Security Policies list at once. There is no second confirmation screen. Finish adding all the permissions in step 4 before you start.

After adding or modifying domain security policy permissions for your integration security group, you must activate these changes to make them effective. This step is required in Workday before Auditoria SmartResearch can access the newly permitted data sources.

1. In the Workday search bar, type "Activate Pending Security Policy Changes" and select the corresponding task from the results.

2. In Description for Change, enter a short description (for example, “Auditoria SmartResearch permissions”).

3. Review the Domain Security Policies list on the same screen. It shows every pending change, when it was made and by whom. If the list contains changes you don’t recognize, check with your Workday administrator before you continue.

4. Select OK. Workday activates the changes and shows View Security Policy Changes with the message “The task was completed successfully.”

Figure 13. Activate Pending Security Policy Changes in the search results

Figure 14. The Description for Change field and the pending changes list

Note:

• This step must be completed for any new or modified domain security policy permissions to take effect.

If you have questions about which policy changes need to be activated, consult your Workday administrator or your implementation team.

6. Get API client credentials

To enable secure integration between Auditoria SmartResearch and your Workday tenant, you need to register an API client and collect the required credentials.

1. Log in to your Workday console with administrative access.

2. Search for “Register API Client for Integrations” in the Workday search bar and select it from the results.

3. Enter a distinctive Client Name (for example, Auditoria_SmartResearch_Client).

4. Select the Non-Expiring Refresh Tokens checkbox, if permitted by your organization’s policy. If it isn’t permitted, the refresh token expires. When it does, generate a new refresh token in Workday and enter it in the Workday connection in Auditoria.

5. In the Scope (Functional Areas) field, add these functional areas:

   • Integration

   • Staffing

   • System

   • Workday Everywhere

   • Supplier Accounts

   • Suppliers

   • Customer Accounts

   • Customers

6. Select OK to complete registration.

7. Record the Client ID and Client Secret generated for this client. These values are required during the Auditoria SmartResearch system setup.

Figure 15. Register API Client for Integrations in the search results

Figure 16. The Register API Client for Integrations form

Figure 17. The registered API client with its Client ID and Client Secret

Note:

• Keep your Client ID and Client Secret secure and confidential.

• Provide scopes only for those functional areas necessary for Auditoria SmartResearch.

7. Generate refresh token with updated permissions

After you register your API client and assign all required permissions, you must generate a refresh token for Auditoria SmartResearch to securely authenticate with your Workday tenant.

Important:

• Add all required permissions to the security group, and all required scopes to the API client, before you generate the refresh token.

1. Log in to your Workday console with administrative access.

2. Search for “View API Clients” and select it from the results.

3. Select the API Clients for Integrations tab.

4. Filter your API Clients (optional but recommended). Use the Add Filter feature and set the filter:

   • Column: Client Name

   • Filter Condition: contains

   • Value: SmartResearch

5. Select Filter to narrow down the API client list.

6. Find your registered Auditoria SmartResearch API client in the filtered results.

7. Select the three dots (…) next to your API client’s name, and select API Client > Manage Refresh Tokens for Integrations.

8. In the prompt, select or enter the Workday ISU you created for SmartResearch (for example, ISU_Auditoria_SmartResearch).

9. On the next screen, select Generate New Refresh Token.

10. Select OK to generate the token.

11. When the refresh token appears, copy and store it securely. You will need this token for the Auditoria SmartResearch connection setup.

Figure 18. View API Clients in the search results

Figure 19. The Add Filter dialog on the API Clients for Integrations tab

Figure 20. The Manage Refresh Tokens for Integrations action

Figure 21. The Workday Account prompt

Figure 22. The deletion warning and the Generate New Refresh Token option

Figure 23. The generated refresh token

Important:

• The refresh token is confidential and should be shared only with the authorized integration team.

Note: If you have any Segmented Security configured in Workday for the following business objects, also add the ISU or the Security Group created for the Auditoria–Workday connection to the same security group.

• Supplier

• Customers

• Customer Invoices

• Supplier Invoices

• Customer Payments

• Supplier Payments

• Purchase Orders

• Entity

If you encounter issues or need help at any step, contact your Workday administrator or Auditoria support representative.

Connect Auditoria SmartResearch to Workday ERP

After gathering your Workday connection details (hostname, tenant name, Integration System User credentials, API client credentials, and refresh token), you are ready to set up the connection within Auditoria.

1. Log in to Auditoria as a Super Admin. Only a Super Admin can add or change a connection. See Roles and Access.

2. Navigate to Administration > System Settings.

3. Add or update the Workday ERP connection:

   • To add a connection, select Add New Connection, select ERP, and then select Workday (under Universal ERP).

   • To update the SmartResearch connection you set up with this article, locate its Workday system tile and select Update.

4. On the ERP Settings page, fill in the following fields with your Workday integration details:

   • Instance Name: Enter a recognizable display name for this connection.

   • Tenant ID: Enter your Workday tenant name.

   • User ID: Enter the Integration System User (ISU) username.

   • User Password: Enter the ISU password.

   • Host Name: Enter the host of your Workday REST API endpoint, without https:// or a path (for example, wd2-impl-services1.workday.com). The View API Clients page shows the full endpoint as Workday REST API Endpoint.

   • Client ID: Enter the API Client ID.

   • Client Secret: Enter the API Client Secret.

   • Refresh Token: Enter the generated refresh token.

   • Additional report and configuration fields may be present. Complete these as required for your organization or leave as “-” if not needed.

5. Under Entities to sync, select the Workday companies to sync. The list loads after the other connection fields are complete.

6. Select Save, or Update if you are updating an existing connection.

7. To sync right away, select Show Existing Systems, and on the Workday connection card select the sync icon (tooltip Initiate Sync Now). When the sync status bar shows Sync Completed, the sync succeeded. If you don’t sync manually, Auditoria syncs each connection every 4 hours. For details, see Workday Settings and Accessing Connected Systems.

Figure 24. Workday under Universal ERP on the Add New Connection page

Figure 25. The ERP Settings fields for a Workday connection

Notes:

• Fill out only the Workday connection fields needed for Auditoria functionality. Optional fields may be left blank or set to “-” as indicated on the screen.

• If you encounter authentication or connection issues, verify all credentials, and confirm required permissions in Workday have been assigned.

Point SmartResearch at the connection

A SmartResearch instance reads your Workday data only through the connections in its scope. Scope it to the Workday connection you just created. Only a Super Admin can save an instance.

1. In Auditoria, select Agent Co-workers, and then under Autonomous Planning and Analysis, select SmartResearch.

2. Select Run. Enter an Instance Name and an Instance Description, and then select Continue.

3. Under SmartResearch Scope, select Select, choose SOR, select the Workday connection you created, and then select OK. Scope can’t be changed after the instance is created.

4. Select Continue, review the configuration, and then select Run.

Related information

• Add SmartResearch to a SmartVendor ISU

• Add SmartResearch to a SmartCustomer ISU

• Add SmartResearch to a SmartVendor and SmartCustomer ISU

• Workday Settings

• Accessing Connected Systems