Syncing Members from Workday

Sync Members from Workday HR to Popl Teams and utilize auto syncs for new or removed members.

Overview

To authenticate your Workday account, you will need to provide the following information:

WSDL
ISU Username
ISU Password
Workday Tenant Name

Prerequisites

Please ensure you fulfill all the requirements to set up the integration:

You have Administrator permissions in your company's Workday instance

Instructions

Step 1: Create an Integration System User (ISU)

In your Workday portal, log into the Workday tenant
In the Search field, type Create Integration System User
Select the Create Integration System User task
On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password Important: "&", "<", or ">" characters cannot be included in the password
Click OK
To ensure the password doesn't expire, you'll want to add this new user to the list of System Users. To do this, search for the Maintain Password Rules task.
Add the ISU to the System Users exempt from password expiration field
Enter the Integration System User name in the linking flow
Enter the Integration System User password in the linking flow

Step 2: Create a Security Group and assign an Integration System User

In the Search field, type Create Security Group
Select the Create Security Group task.
On the Create Security Group page, select Integration System Security Group (Unconstrained) from the Type of Tenanted Security Group pull-down menu.
If you would like to create a Constrained Security Group instead of an Unconstrained Security Group, please see the section in Notes below.
In the Name field, enter a name
Click OK
On the Edit Integration System Security Group (Unconstrained) page, in the Integration System Users field, enter the same name you entered when creating the ISU in the first section
Click OK

Step 3: Configure domain security policy permissions

In the Search field, type Maintain Permissions for Security Group
Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2
On the next screen, add the corresponding Domain Security Policies depending on your use case:
- If you are connecting Workday HRIS
- If you are connecting Workday ATS (Recruiting)

Step 4: Activate security policy changes

In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved
Add any relevant comments on the window that pops up
Confirm the changes in order to accept the changes that are being made and hit OK

Step 5: Validate the authentication policy is sufficient

Search for Manage Authentication Policies
Click Edit on the authentication policy row
Create an Authentication Rule
Enter a name, add the Security Group, and ensure Allowed Authentication Types is set to Specific User Name Password or Any

Note: You don't have to create a new Authentication Rule if you already have an existing one set to User Name Password or Any. You can add the ISU you created to that rule instead. You will need to create a new rule if SAML is the only Authentication Rule you see for "Allowed Authentication Types."

Step 6: Activate all pending authentication policy changes

In the search bar type, activate all pending authentication policy changes
Proceed to the next screen and confirm the changes. This will save the Authentication Policy that was just created or edited

Step 7: Obtain the web services endpoint URL

Search in Workday for Public Web Services
Find Human Resources (Public) if you are connecting Workday HRIS. Find Recruiting if you are connecting Workday ATS. Click the three dots to access the menu. Click Web Services > View WSDL
Navigate to the bottom of the page that opens (it may take a few seconds to load)
Copy the full URL provided under Human_ResourcesService (Workday HRIS) or RecruitingService (Workday ATS). The URL will have a format similar to https://wd2-impl-services1.workday.com/ccx/service/acme/Human_Resources/v43.0
Enter the Web Services Endpoint URL into the linking flow
Click Submit

Step 8: Complete Workday Setup on Popl Dashboard

Once next is clicked in step 7, you should be fully authenticated with Workday. Click "Close window" to close the auth popup.
Now that you have authenticated, you are ready to start setting up the Workday sync configuration here: https://dash.popl.co/integrations/workday. Note: It may take 5-10 minutes for the Workday sync to fetch all groups. An email will be sent to you as the Popl Team admin as soon as this group syncing is complete.

Choosing Groups to Sync

In the first section, there is a search bar that will allow you to choose which Workday groups you'd like to sync to Popl Teams. You can either scroll through all groups by clicking the search bar or search for specific groups by typing group names in the search bar.

Once group(s) are selected and members are synced, the integration will automatically add those members to subteams on Popl with the same name as their respective Workday group. For example, if you have a synced Workday group called "popl_users" with 2,000 members, when those 2,000 members are synced to Popl, they will automatically be added to a subteam named "popl_users". This helps bring the directory organization from Workday over to Popl Teams.

Auto Sync Frequency

In the section, you can choose an auto sync cadence that will automatically create or remove digital business cards as employees join or leave your company.

Available Auto Sync cadences include:
- Daily (Recommended)
- Weekly
- Monthly
- Quarterly

We recommend choosing the daily sync here as it ensures the most up-to-date business info and member allocation is kept synced at all times.

This auto sync frequency can be changed by an admin at any time. When an auto sync occurs successfully, all Popl Team admins will be notified of any member additions and deletions via email ensuring data cleanliness and visibility. Daily auto syncs occur every day at 12am PST.

Select Fields To Sync

In this section, default fields like name, email, and more can be set up and configured. By default, these fields are what are synced to your digital business cards out-of-the-box. The email and phone number fields will be used to create email and phone tappable links on each digital card, and a user's email will be used as the account email for logging in.

The default synced fields are mapped as below:

Note: Custom fields can be set up easily, just let us know which fields you'd like to be mapped over and we will complete within 1-2 days. Send us an email here: teams@popl.co.

Sync Toggles

When a field has the toggle for "Sync" turned on, this means that when the integration finds a new member in one of the synced Workday groups that has not yet been created on Popl, it will create that member with this field added. The default is to keep all sync toggles turned on.

Overwrite Toggles

When a field has the toggle for "Overwrite" turned on, this means when the integration finds a member in one of the synced Workday groups that already exists on Popl, it will overwrite this field with new data from Workday on future syncs. For example, if John Smith has the title "Director of Sales" and gets a promotion to "VP of Sales", when the auto sync sees John's title has changed on the Workday side, if the overwrite toggle for Job title is turned on, the next auto sync will see this update on Workday and update John's job title on his Popl digital business card. If this toggle is turned off, any changes on the Popl side for John's job title will not be overwritten by future Workday auto syncs.

Mapping Custom Fields

Our Workday sync is very robust and can be set up with any number of custom mappings from Workday to Popl. If you'd like to map custom fields from Workday to each member's Popl digital cards, send us an email to teams@popl.co and we will complete within 1-2 days.

Deleting Members Upon Removal

When this toggle is turned on, the integration will fully delete members from Popl when they are removed from your synced Workday groups. These deletions will be permanent and cannot be reversed, so please consider carefully before enabling this feature.

The goal of this toggle is to provide our customers with data cleanliness. By default (when this option is turned off), removing members means just removing them from the Popl Team and deactivating their teams subscription. If this option is toggled on, not only will members be removed, but they will also be fully deleted from our database to ensure complete data hygiene.

Send Email Invites

With this toggle, you can choose whether to send email invites to new members or not. When this option is toggled on, any auto sync or manual sync will send new members an invite email to join the team and claim their digital business card. If this is toggled off, no email will be sent on member creation. If no invite is sent, always remember to send the invites later!

We recommend turning this option on so that members can claim and start sharing as soon as they are added to the team!

Running a Manual Sync

Once all configuration is set up, click "Save Configuration" in the bottom right. This will save all updated configuration and apply it for the next manual or auto sync. If this button is greyed out, that means, all info has already been saved. To run a manual sync at any time, simply click "Sync Now" in the bottom right.

Logic for your First Sync

During your first sync, Popl Teams will create digital business cards for each member with the attribute mappings that have the "sync" toggle turned on.

If a member's email from the sync is already attached to a Popl digital business card, we will simply invite the existing member instead of creating a duplicate member. This Workday sync will never create duplicate members. The existing Popl user will get an email invite to join your team on Popl Teams unless you have "Send Email Invites" toggled off.

If an existing member has a template applied, values from Workday such as email and phone number will be added to the existing template unique links/content instead of duplicate links being created. For example, if a template is applied to John Smith and that template contains a unique email link like in the right option shown below, the Workday sync will update this unique email link with it's email value instead of creating a duplicate email link.

Logic for all Future Syncs

As your company grows, names, titles, departments, and other member info can change. With any sync after your initial one, auto syncs will automatically update Popl digital cards to correct, up-to-date info without any manual entry required.

For example, let's say that Jessica Swift gets a promotion and her title changes from Marketing Manager to Director of Marketing in Workday. After a successful daily, weekly, monthly or quarterly auto sync, this title change will instantly reflect on Jessica's digital business card. Syncs can also be run manually by clicking the "Edit Setup" button at any time from the add members page or the integrations tab.

Important Notes on Workday Authentication

Implementation/sandbox tenant Workday accounts will result in slower syncs, as fewer resources are dedicated to the tenant

(Optional) Create a Constrained Security Group instead of Unconstrained

The following steps would replace Step 2 above.

In the Search field, type Create Security Group.
On the Create Security Group page, select Integration System Security Group (Constrained) from the Type of Tenanted Security Group pull-down menu.
In the Name field, enter a name.
Click OK
On the Edit Integration System Security Group (Constrained) page, in the Integration System Users field, enter the ISU you created in Step 1
Now under Organizations, you will need to select the appropriate way you'd like to limit access from your Workday instance. You have several options in regards to how you'd like to limit the data accessible to the ISU: We recommend selecting a specific organizational structure within your larger Company to segment by
After clicking on "All Organizations by Type", you can further narrow down by selecting which Type you'd like to segment by. The recommended types are:
- Company
- Cost Center
- Division
- Region
From there, you can select the specific Instances within your Workday Organization that you'd like to be synced over from this security Group (specific Regions, divisions, etc.)
After you have configured the Organization Structures you'd like to be accessible from the ISU, please navigate to "Access Rights to Organization". Depending on how you'd like to configure access, it can either be to the specific criteria you've applied on the Organizations section or the criteria you applied as well as all organizations that fall under. If you have only selected a top level organization, you should click "Applies to Current Organization And All Subordinates"
Once this is all completed, click OK to save the Constrained Security Group
Now continue to Step 3.