Add SmartResearch to a SmartVendor and SmartCustomer ISU

Introduction

This guide is for organizations that already connect Workday to Auditoria for both SmartVendor and SmartCustomer and are adding Auditoria SmartResearch. Your Auditoria Integration System User (ISU) already has the permissions from both Setting Up a Workday ISU for Auditoria AP Helpdesk and Setting Up an Integration System User (ISU) for Auditoria SmartCustomer Products. SmartResearch needs some additional read-only permissions.

Before you start: The tables in this guide assume your SmartVendor ISU was set up with Setting Up a Workday ISU for Auditoria AP Helpdesk. If it was set up with a different article, compare your security group with the full tables in Set Up a Workday ISU for SmartResearch (New Customers) and add every permission your group doesn’t already have. If SmartVendor and SmartCustomer use separate ISUs, follow Add SmartResearch to a SmartVendor ISU for your SmartVendor ISU instead.

This guide lists only the permissions to add, and walks you through adding them to the security group your Auditoria ISU belongs to, updating your API client, and refreshing the Auditoria connection. If you have questions during the setup, contact your Workday administrator or your Auditoria support representative.

Prerequisites

Before you begin, have the following in place:

• Workday administrative access: You must have privileges to edit domain security policies, activate pending security policy changes, and edit API clients.

• Auditoria SmartResearch licensing: Confirm that your organization has an active Auditoria SmartResearch subscription.

• Your existing integration details: The name of the integration system security group that contains your Auditoria ISU, and the name of your Auditoria API client.

• Auditoria administrative access: To update the Workday connection in Auditoria.

• Coordination with your IT and Workday teams: Tell all stakeholders involved in Workday integration and data security about these changes.

If you do not have these permissions, contact your Workday administrator or your internal IT team for assistance.

Update Workday for SmartResearch

1. Add domain security policy permissions for SmartResearch

To enable Auditoria SmartResearch to access the required data from your Workday tenant, you must assign the correct domain security policy permissions to the integration security group that contains your Auditoria ISU.

1. Log in to your Workday console with administrative privileges.

2. In the Workday search bar, type "Security group" and select View Security Group from the search results.

3. In the prompt, enter the name of your group (for example, ISSG_Auditoria).

4. Select OK.

5. On the Integration System Security Group (Unconstrained) overview page, select the Related Actions (three dots menu) next to the group name.

6. Select Security Group > Maintain Domain Permissions for Security Group.

7. If an Errors & Warnings grid opens before the form, select OK to continue.

8. In the Report/Task Permissions and Integration Permissions sections, add the required Domain Security Policies for each SmartResearch data source, using the operation/access level provided in the table below. Use Modify, View, Get, or Put access level as specified.

   The Operation value in each table row tells you which fields to add the policy to:

   • View Only: Domain Security Policies permitting View access.

   • View and Modify: Domain Security Policies permitting View access and Domain Security Policies permitting Modify access.

   • Get Only: Domain Security Policies permitting Get access.

   • Get and Put: Domain Security Policies permitting Get access and Domain Security Policies permitting Put access.

9. Select OK to save your changes.

Figure 1. View Security Group in the search results

Figure 2. The View Security Group prompt

Figure 3. The Maintain Domain Permissions for Security Group action

Figure 4. The four permission fields on the Maintain Domain Permissions form

Add the permissions in Table 1. It lists the AP permissions that your SmartVendor ISU doesn't already have. Your ISU already has every AR permission SmartResearch needs.

Table 1. Additional Domain Security Policy Permissions (AP)

If you have questions about specific domain security policies or data source configurations, consult your Workday administrator or Auditoria support representative.

2. Activate pending security policy changes

Important: Selecting OK activates every change in the Domain Security Policies list at once. There is no second confirmation screen. Finish adding all the permissions in step 1 before you start.

After adding or modifying domain security policy permissions for your integration security group, you must activate these changes to make them effective. This step is required in Workday before Auditoria SmartResearch can access the newly permitted data sources.

1. In the Workday search bar, type "Activate Pending Security Policy Changes" and select the corresponding task from the results.

2. In Description for Change, enter a short description (for example, “Auditoria SmartResearch permissions”).

3. Review the Domain Security Policies list on the same screen. It shows every pending change, when it was made and by whom. If the list contains changes you don’t recognize, check with your Workday administrator before you continue.

4. Select OK. Workday activates the changes and shows View Security Policy Changes with the message “The task was completed successfully.”

Figure 5. Activate Pending Security Policy Changes in the search results

Figure 6. The Description for Change field and the pending changes list

Note:

• This step must be completed for any new or modified domain security policy permissions to take effect.

If you have questions about which policy changes need to be activated, consult your Workday administrator or your implementation team.

3. Update the scopes on your API client

SmartResearch reads additional functional areas, so your Auditoria API client needs the matching scopes.

1. Log in to your Workday console with administrative access.

2. Search for “View API Clients” and select it from the results.

3. Select the API Clients for Integrations tab.

4. Select the three dots (…) next to your Auditoria API client’s name, and select API Client > Edit API Client for Integrations.

5. In the Scope (Functional Areas) field, make sure these areas are present:

   • Integration

   • Staffing

   • System

   • Workday Everywhere

   • Supplier Accounts

   • Suppliers

   • Customer Accounts

   • Customers

   Add any that are missing.

6. Select OK.

Figure 7. The Edit API Client for Integrations action

4. Generate a new refresh token

After the new permissions are activated and the scopes are added, generate a new refresh token for Auditoria SmartResearch to securely authenticate with your Workday tenant.

Important:

• Add all required permissions to the security group, and all required scopes to the API client, before you generate the refresh token.

• Generating a new refresh token deletes the existing refresh token for this API client and ISU. Your current Auditoria connection stops working until you enter the new token in Auditoria, so plan this step for a quiet period.

1. Log in to your Workday console with administrative access.

2. Search for “View API Clients” and select it from the results.

3. Select the API Clients for Integrations tab.

4. Filter your API Clients (optional but recommended). Use the Add Filter feature and set the filter:

   • Column: Client Name

   • Filter Condition: contains

   • Value: part of your Auditoria API client name

5. Select Filter to narrow down the API client list.

6. Find your Auditoria API client in the filtered results.

7. Select the three dots (…) next to your API client’s name, and select API Client > Manage Refresh Tokens for Integrations.

8. In the prompt, select or enter the Workday ISU your Auditoria connection uses (for example, ISU_Auditoria).

9. On the next screen, select Generate New Refresh Token.

10. Select OK to generate the token.

11. When the refresh token appears, copy and store it securely. You will need this token to update the Auditoria connection.

Figure 8. View API Clients in the search results

Figure 9. The Add Filter dialog on the API Clients for Integrations tab

Figure 10. The Manage Refresh Tokens for Integrations action

Figure 11. The Workday Account prompt

Figure 12. The deletion warning and the Generate New Refresh Token option

Figure 13. The generated refresh token

Important:

• The refresh token is confidential and should be shared only with the authorized integration team.

Note: If you have any Segmented Security configured in Workday for the following business objects, also add the ISU or the Security Group created for the Auditoria–Workday connection to the same security group.

• Supplier

• Customers

• Customer Invoices

• Supplier Invoices

• Customer Payments

• Supplier Payments

• Purchase Orders

• Entity

If you encounter issues or need help at any step, contact your Workday administrator or Auditoria support representative.

Update the Auditoria connection

Enter the new refresh token in the existing Workday connection in Auditoria.

1. Log in to Auditoria as a Super Admin, and navigate to Administration > System Settings. Only a Super Admin can add or change a connection. See Roles and Access.

2. Locate the Workday system tile and select Update.

3. On the ERP Settings page, replace the value in Refresh Token with the token from step 4.

4. Select Update.

5. To sync right away, select Show Existing Systems, and on the Workday connection card select the sync icon (tooltip Initiate Sync Now). When the sync status bar shows Sync Completed, the sync succeeded. If you don’t sync manually, Auditoria syncs each connection every 4 hours. For details, see Workday Settings and Accessing Connected Systems.

Figure 14. The Update button on the Workday connection tile

Figure 15. The ERP Settings fields, including Refresh Token

If you encounter authentication or connection issues, verify the refresh token, and confirm that the new permissions were activated in Workday.

Check the SmartResearch instance scope

A SmartResearch instance reads your Workday data only through the connections in its scope. Only a Super Admin can save an instance.

• If a SmartResearch instance is already running, check its SmartResearch Scope in the Running Instances table. If it doesn’t include your Workday connection, or the SmartVendor or SmartCustomer instance that uses it, contact your Auditoria support representative.

• If no instance is running, create one with the steps below.

1. In Auditoria, select Agent Co-workers, and then under Autonomous Planning and Analysis, select SmartResearch.

2. Select Run. Enter an Instance Name and an Instance Description, and then select Continue.

3. Under SmartResearch Scope, select Select, choose SOR, select your existing Workday connection, and then select OK. Scope can’t be changed after the instance is created.

4. Select Continue, review the configuration, and then select Run.

Related information

• Set Up a Workday ISU for SmartResearch (New Customers)

• Add SmartResearch to a SmartVendor ISU

• Add SmartResearch to a SmartCustomer ISU