Smart - Customer Knowledge BaseSmart - User Guide ConfigurationProvisioning Workday tenants for Smart - Self Service Provisioning (SSP)

Provisioning Workday tenants for Smart - Self Service Provisioning (SSP)

Smart requires specific configuration on your Workday tenants to enable it to execute automated tests. At a high level this includes:

  • A Smart Integration System User
  • A Security Group with specific Domain Security Policies
  • Updating Business Process Security Policies to allow Smart to Cancel and Rescind transactions via web service
  • Custom Reports and Calculated Fields

You can provision any non-production Workday tenant for Smart.

If you are already live with Workday, then due to the Sandbox tenant refresh process you will need apply this configuration to your testing tenants after every refresh from Production.

Kainos will perform the initial configuration but we recommend that customers take ownership of the process. The provisioning process is known as Self Service Provisioning (SSP), and can be automated by a single button click from within the customer’s Smart tenant.

If you would like to have your Workday tenant configured to allow SSP, please contact the Kainos Smart Customer Support team for more information.

Smart Workday Tenant Requirements

During Onboarding and initial tenant setup, the Kainos Smart Professional Services team will require access to your Workday tenant(s), to apply configuration and enable Smart to execute tests against them. To fulfill this, a member of the Kainos Smart Professional Services/Smart Customer Support team should be setup with a named user account on your Workday tenant(s).

As a minimum we recommend one named user from Kainos Smart Professional Service/Smart Customer Support being set up with access to apply Smart configuration to a Workday tenant. However, we advise that additional users from the Kainos Smart Professional Services/Smart Customer Support team are also created, to ensure that your use of Smart can be supported more effectively. 

Kainos recommends that customers create an Implementer Account for the Kainos Named User e.g. jsmith-impl.

Alternatively, if granting implementer access is not possible, customers can grant required access by following these steps:

  1. Create a named, Integration System User e.g. jsmith-smart
  2. Create new Integration System Security Group (Unconstrained) called Kainos Smart Users
  3. Grant Domain Security permissions listed below (required set of permissions to launch SSP):
Policy View Modify Get Put
Security Administration FALSE TRUE FALSE FALSE
Security Configuration FALSE TRUE FALSE FALSE
Business Process Administration TRUE FALSE FALSE FALSE
Set Up: Tenant Setup - HCM FALSE TRUE FALSE FALSE
Integration Security FALSE TRUE FALSE FALSE
Workday Accounts FALSE TRUE FALSE FALSE
Custom Report Creation FALSE TRUE FALSE TRUE
Configuration Set: Custom Reports and Fields FALSE FALSE FALSE TRUE
Manage: All Custom Reports FALSE FALSE FALSE TRUE
Security Activation FALSE TRUE FALSE FALSE

If customers are live with Workday, it is recommended that this access is created in the Production environment, putting in place an authentication policy that will block access to Production, but allow the accounts to copy down into your testing tenants after a refresh. For more information on the creation of this authentication policy, please see the section on Workday Authentication Policies.

Configuring non-production Workday tenants for Smart

Users with implementer or equivalent level of access to their Workday tenant will have the option of launching the SSP process from within Smart, described in the Launching SSP on a New Test Tenant section.

SSP will apply the following configuration on the non-production Workday tenant:

  • Maintain User Name Rules to ensure the user name length is 22 characters or more - required to create the Smart System User.
  • Create Integration System System User called "kainossmart-intsysuser"
  • Create a single Integration System Security Groups (Unconstrained):
    • Kainos Smart Permissions Group

with the following permissions:

Policy View Modify Get Put
Worker Data: Compensation Grade TRUE FALSE TRUE FALSE
Business Process Administration FALSE TRUE TRUE FALSE
Worker Data: Benefit Eligibility TRUE FALSE TRUE FALSE
Person Data: Birth Place TRUE FALSE TRUE FALSE
Worker Data: Business Title on Worker Profile TRUE FALSE TRUE FALSE
Person Data: ID Information TRUE FALSE TRUE FALSE
Worker Data: International Assignments TRUE FALSE TRUE FALSE
Worker Data: Payroll (Pay Group Specific) TRUE FALSE TRUE FALSE
Worker Data: Payroll Interface (Pay Group Specific) TRUE FALSE TRUE FALSE
Worker Data: Payroll Interface (Tax Elections) TRUE FALSE TRUE FALSE
Worker Data: Worker Summary Reports TRUE FALSE FALSE FALSE
View: Business Asset TRUE FALSE TRUE FALSE
Reports: Business Assets TRUE FALSE TRUE FALSE
Custom Report Administration FALSE TRUE FALSE TRUE
Custom Report Creation FALSE TRUE FALSE TRUE
Integration Process FALSE FALSE FALSE TRUE
Integration Reports FALSE TRUE FALSE TRUE
Manage: Address Information TRUE FALSE TRUE FALSE
Integration Build TRUE FALSE TRUE FALSE
Manage Pre-Hire Process: Consider Pre-Hires TRUE FALSE TRUE FALSE
Manage: Supervisory Organization TRUE FALSE TRUE FALSE
Reports: Manager TRUE FALSE TRUE FALSE
Reports: Manager (Pre-Hire) TRUE FALSE TRUE FALSE
Search: Find Worker TRUE FALSE TRUE FALSE
Set Up: Base and Plan TRUE FALSE TRUE FALSE
Set Up: Leave of Absence TRUE FALSE TRUE FALSE
Worker Data: Active and Terminated Workers TRUE FALSE TRUE FALSE
Worker Data: All Positions TRUE FALSE TRUE FALSE
Worker Data: Beneficiaries and Dependents TRUE FALSE TRUE FALSE
Worker Data: Compensation by Organization TRUE FALSE TRUE FALSE
Worker Data: Compensation Summary by Job Profile TRUE FALSE TRUE FALSE
Worker Data: Current Staffing Information TRUE FALSE TRUE FALSE
Person Data: Date of Birth TRUE FALSE TRUE FALSE
Person Data: Disabilities TRUE FALSE TRUE FALSE
Worker Data: Documents TRUE FALSE TRUE FALSE
Person Data: Emergency Contacts TRUE FALSE TRUE FALSE
Worker Data: Employee Contracts TRUE FALSE TRUE FALSE
Person Data: Gender TRUE FALSE TRUE FALSE
Person Data: Home Address TRUE FALSE TRUE FALSE
Worker Data: Leave of Absence TRUE FALSE TRUE FALSE
Worker Data: Public Worker Reports TRUE FALSE TRUE FALSE
Person Data: Religion TRUE FALSE TRUE FALSE
Worker Data: Retirement Savings TRUE FALSE TRUE FALSE
Worker Data: Stock Grants TRUE FALSE TRUE FALSE
Worker Data: Talent TRUE FALSE TRUE FALSE
Worker Data: Terminations TRUE FALSE TRUE FALSE
Person Data: Work Address TRUE FALSE TRUE FALSE
Person Data: Work Email TRUE FALSE TRUE FALSE
Person Data: Work Instant Messenger TRUE FALSE TRUE FALSE
Person Data: Work Phone TRUE FALSE TRUE FALSE
Worker Data: Work Shifts TRUE FALSE TRUE FALSE
Person Data: Work Web Address TRUE FALSE TRUE FALSE
Business Process Delegation FALSE TRUE TRUE FALSE
Configuration Set: Custom Reports and Fields FALSE FALSE FALSE TRUE
Manage: All Custom Reports FALSE TRUE FALSE TRUE
Workday Accounts FALSE TRUE FALSE TRUE
Academic Units: View TRUE FALSE TRUE FALSE
Appointee Data: Current Appointments TRUE FALSE TRUE FALSE
Audit: Contact Information TRUE FALSE FALSE FALSE
Business Process Reporting TRUE FALSE FALSE FALSE
Candidate Data: Background Check History TRUE FALSE TRUE FALSE
Compensation Change: Total Base Pay TRUE FALSE TRUE FALSE
Job Information TRUE FALSE TRUE FALSE
Job Requisition Data TRUE FALSE TRUE FALSE
Manage Pre-Hire Process: Manage Pre-Hires TRUE FALSE TRUE FALSE
Manage Pre-Hire Process: Pre-Hire Eligibility TRUE FALSE TRUE FALSE
Manage: Company TRUE FALSE FALSE FALSE
Manage: Location TRUE FALSE FALSE FALSE
Manage: Organization Roles TRUE FALSE TRUE FALSE
Pre-Hire Data: Background Check Status TRUE FALSE TRUE FALSE
Reports: Open Positions TRUE FALSE TRUE FALSE
Set Up: Benchmark Jobs TRUE FALSE TRUE FALSE
Set Up: Organization TRUE FALSE TRUE FALSE
Set Up: Stock TRUE FALSE TRUE FALSE
Set Up: Time Off (Calculations - Absence Specific) TRUE FALSE TRUE FALSE
Worker Data: Active Employees TRUE FALSE FALSE FALSE
Worker Data: Background Check Status TRUE FALSE TRUE FALSE
Worker Data: Benefit Elections TRUE FALSE TRUE FALSE
Worker Data: Benefits TRUE FALSE TRUE FALSE
Person Data: Citizenship Status TRUE FALSE TRUE FALSE
Worker Data: Collective Agreements TRUE FALSE TRUE FALSE
Worker Data: Contingent Worker Assignment Details TRUE FALSE TRUE FALSE
Person Data: Ethnicity TRUE FALSE TRUE FALSE
Worker Data: Funded Plan Assignments TRUE FALSE TRUE FALSE
Worker Data: Headcount Reports TRUE FALSE TRUE FALSE
Worker Data: Historical Staffing Information TRUE FALSE TRUE FALSE
Person Data: Home Email TRUE FALSE TRUE FALSE
Person Data: Home Instant Messenger TRUE FALSE TRUE FALSE
Person Data: Home Phone TRUE FALSE TRUE FALSE
Person Data: Home Web Address TRUE FALSE TRUE FALSE
Person Data: Marital Status TRUE FALSE TRUE FALSE
Worker Data: Market Position Details TRUE FALSE TRUE FALSE
Person Data: Medical Exams TRUE FALSE TRUE FALSE
Person Data: Military Status TRUE FALSE TRUE FALSE
Worker Data: Payroll (Company Specific) - USA TRUE FALSE TRUE FALSE
Worker Data: Payroll (Costing Override) TRUE FALSE FALSE FALSE
Worker Data: Payroll Interface (Costing Overrides) TRUE FALSE FALSE FALSE
Worker Data: Performance Reviews TRUE FALSE TRUE FALSE
Worker Data: Period Activity Pay TRUE FALSE TRUE FALSE
Worker Data: Probation Periods TRUE FALSE TRUE FALSE
Worker Data: Retirees TRUE FALSE FALSE FALSE
Worker Data: Staffing TRUE FALSE FALSE FALSE
Worker Data: Staffing Reports with Compensation Data TRUE FALSE FALSE FALSE
Worker Data: Time Off (Time Off) TRUE FALSE TRUE FALSE
 Set Up: Contact Info, IDs, and Personal Data FALSE TRUE FALSE FALSE
Process: I-9 Forms - USA FALSE FALSE TRUE FALSE
Worker Data: I-9 Forms - USA FALSE FALSE TRUE FALSE
Find Candidates: Internal and External FALSE FALSE TRUE FALSE
Worker Data: Unions FALSE FALSE TRUE FALSE
Person Data: Nationalities FALSE FALSE TRUE FALSE
Talent Pool: View and Edit TRUE FALSE FALSE FALSE
Worker Data: Succession TRUE FALSE FALSE FALSE
Worker Data: Calibration TRUE FALSE FALSE FALSE
Worker Data: Employee Reviews TRUE FALSE FALSE FALSE
Worker Data: Compensation Management by Organization TRUE FALSE FALSE FALSE
Worker Data: Business Assets TRUE FALSE FALSE FALSE
Worker Data: Payroll (Payment Elections) TRUE FALSE FALSE FALSE
Custom Label Management FALSE FALSE TRUE FALSE
Reports: Financial Accounting TRUE FALSE FALSE TRUE
Reports: Customer Accounts TRUE FALSE TRUE FALSE
Reports: Supplier Accounts TRUE FALSE TRUE FALSE
Process: Journals (NEW) TRUE FALSE FALSE TRUE
Process: Journals - View TRUE FALSE FALSE TRUE
Process: Supplier Invoice TRUE FALSE FALSE FALSE
Integrations: Workfeed TRUE FALSE TRUE FALSE
Process: Receipt TRUE FALSE FALSE FALSE
Process: Requisition TRUE FALSE FALSE FALSE
Process: Supplier Contract (NEW) TRUE FALSE FALSE FALSE
Reports: Supplier TRUE FALSE TRUE FALSE
View: Supplier TRUE FALSE FALSE FALSE
Set Up: Credit Card TRUE FALSE FALSE FALSE
Worker Data: Veteran Status Identification TRUE FALSE FALSE FALSE
Recruiting Agency Careers TRUE FALSE FALSE FALSE
Job Requisitions for Recruiting TRUE FALSE FALSE FALSE
Non-Worker: Compensation Data by Organization TRUE FALSE FALSE FALSE
Process: Supplier Invoice - Reporting FALSE FALSE FALSE TRUE
Process: Customer Invoice Payment TRUE FALSE FALSE FALSE
View: Customer TRUE FALSE FALSE FALSE
Process: Customer Contract TRUE FALSE FALSE FALSE
Process: Project Billing TRUE FALSE FALSE FALSE
Configuration Set: Business Processes FALSE FALSE TRUE FALSE
Business Process Definition View FALSE FALSE TRUE FALSE
Manage: Organization Integration FALSE FALSE TRUE FALSE
Reports: Supplier Accounts 1099 TRUE FALSE FALSE FALSE
Process: Expense Report TRUE FALSE FALSE FALSE
Process: Spend Authorization TRUE FALSE FALSE FALSE
Manage: Service Center TRUE FALSE FALSE FALSE
Set Up: Payroll - Pay Group Specific TRUE FALSE FALSE FALSE
Worker Data: Time Off (Time Off Balances) TRUE FALSE FALSE FALSE
Set Up: Payroll (Calculations - Payroll Specific) TRUE FALSE FALSE FALSE
Process: Customer Invoice - Change TRUE FALSE FALSE FALSE
Process: Customer Invoice - View TRUE FALSE FALSE FALSE
Security Administration FALSE TRUE FALSE FALSE
Security Configuration TRUE FALSE FALSE FALSE
Process: Expense Report - View TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results (Results - Security based on Pay Component Security) TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results (Results - Reports based on Pay Component Security) TRUE FALSE FALSE FALSE
Process: Ad Hoc Payment - View TRUE FALSE FALSE FALSE
Process: Purchase Order - Reporting TRUE FALSE FALSE FALSE
Process: Requisition - View FALSE FALSE TRUE FALSE
Process: Purchase Order TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Worker (Results) TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Worker (Payslips) TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) - USA TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) - CAN TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) - FRA TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) - UK TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) TRUE FALSE FALSE FALSE
Process: Customer Contract - View TRUE FALSE FALSE FALSE
Worker Data: Payroll (Payroll Input) FALSE FALSE FALSE TRUE
Run Batch Calculations (Pay Calculation) FALSE FALSE FALSE TRUE
Process: Spend Authorization - View TRUE TRUE FALSE FALSE
Process: Receipt/Return - View TRUE TRUE FALSE FALSE
  • Add Kainos Smart Permissions Group to Cancel and Rescind web service Actions for the following Business Processes:
Business Process Type Cancel (Web Service) Rescind (Web Service)
Add Academic Appointment Y Y
Add Additional Job Y Y
Add Retiree Status Y Y
Assign Costing Allocation Y Y
Assign Employee Collective Agreement Y Y
Assign Pay Group Y Y
Assign Pay Group for Position Restrictions Event Y Y
Assign Roles Y Y
Assign Superior Y Y
Background Check Y Y
Change Benefit Jobs Y Y
Change Benefits Y Y
Change Benefits for Life Event Y Y
Change Default Compensation Y Y
Change Emergency Contacts Y Y
Change Job Y Y
Change Organization Assignments for Worker Y Y
Complete Federal Withholding Elections Y Y
Complete Form I-9 Y N
Correct Time Off Y N
Create Position Y Y
Create Workday Account Y Y
Edit Government IDs Y Y
Edit ID Information Y Y
Edit Licenses Y Y
Edit Other IDs Y Y
Edit Position Y Y
Edit Position Restrictions Y Y
Employee Contract Y Y
End Academic Appointment Y Y
Evergreen Requisition Y Y
Freeze Position Y Y
Hire Y Y
Hiring Restrictions  Y  Y
Edit Hiring Restrictions  Y  Y
Job Requisition Y Y
Manage Probation Period Y Y
Onboarding Y N
Passports and Visa Change Y Y
Period Activity Pay Y Y
Personal Information Change Y Y
Propose Compensation Hire N Y
Propose Compensation Change N Y
Remove Retiree Status Y Y
Request Compensation Change Y Y
Request Delegation Change Y N
Request Leave of Absence Y Y
Request One-Time Payment Y Y
Request Return from Leave of Absence Y Y
Request Stock Grant Y Y
Request Time Off Y N
Review COBRA Eligibility Event Y Y
Service Dates Change Y Y
Termination Y Y
Update Academic Appointment Y Y
Create Subordinate Y Y
Service Dates Change Y Y
End International Assignment Y Y
Start International Assignment Y Y
Switch Primary Job Y Y
Assign Work Schedule Y Y
Contract Contingent Worker Y Y
Contact Change Y Y
Dependent Event Y Y
Complete Federal Withholding Elections Y Y
Complete State and Local Withholding Elections Y Y
End Contingent Worker Contract Y Y
Severance Worksheet Y Y
Manage Education Y Y
Edit Workday Account Y Y
Union Membership Event Y Y
End Additional Job Y Y
Assign Matrix Organization Y Y
Home Contact Change Y Y
Work Contact Change Y Y
  • Edit Password Rules and set following values to 0:
    • Days Before Password May Be Re-used
    • Number of Passwords before Password Reuse
  • Set kainossmart-intsysuser Preferred Locale and Preferred Language to English (United States) – en_US
  • Activate Pending Security Policy Changes
  • Upload Smart Calculated Fields and Custom Reports, which are required for Smart to operate on a customer Workday tenant

Upon SSP completion, the Proxy Access Policy should be configured in order to allow Smart to proxy on behalf of All Users Security Group.

If there is an Authentication Policy enabled, it should be updated to allow Kainos Smart to access the Workday tenant.

If you are live with Workday it is recommended to configure Proxy Access Policy and Authentication Policy for non-production Workday tenants in your Production tenant, so they automatically propagate to any testing tenants refreshed from Production. 

If SSP is enabled on the Smart tenant and the provisioned Workday tenant has been refreshed, its status will be set to Configuration Missing. To re-initiate the SSP process, please refer to Re-launching SSP section.

Launching SSP on a New Test Tenant

1. First, select the Workday Tenants option from the Smart ADMIN menu.

This will bring you to the Workday Tenant Configurations screen.

2. Select Create New. This will present the user with a Tenant Configuration screen (please refer to Creating a New Workday Tenant section for more details):

When all details have been correctly entered, select Apply Configuration. The following prompt will appear:

At this point, users can enter their implementer or equivalent credentials and select Verify. Smart will verify that these credentials are at a sufficient level in order to initiate the process and, providing this is true, present a Provisioning Run Details page providing information on the Self Service Provisioning process progress. More information on the required permissions is available by clicking What is an equivalent level of access? This will display a list of Domain Security Policies Permissions that are necessary to successfully complete the Provisioning process (please refer to Smart Workday Tenant Requirements section for more details).

Upon SSP initialization the Provisioning Run Details page will be displayed listing the Smart Provisioning tasks.

Opening Provisioning Tasks will provide more details on configuration applied by Smart in the Workday tenant.

If you wish for a member of the Kainos Smart Customer Support team to carry out the process of adding a new tenant, they will need to be granted named user access on the relevant Workday tenant, as well as the necessary security permissions to carry out the process. Please contact the Kainos Smart Customer Support team for further information.

Re-launching SSP

If users wish to re-configure their tenants after a weekly refresh, it is simply a matter of navigating to the Tenant Configuration page and selecting Edit beside the tenant which needs to have the configuration re-applied.

The Tenant Configuration screen will be presented, along with an option to Retry the provisioning process. At this point the Workday Credentials screen shown above will prompt the user for valid credentials, which will be verified and used to re-executed the SSP process. Once again, when completed, the initiating user will receive a summary email to their email address.

Cannot Login

If your Workday tenant status in Smart is set to Cannot Login, and the Workday tenant in question has not had a refresh, this is indicative that the kainossmart-intsysuser account exists, however Smart cannot currently access the Workday tenant.

This can be caused by the following:

  • Account Expiry - If it has been a while since the kainossmart-intsysuser account was created the account may have expired, and will need to have either its expiry date extended, or an expiry exemption put in place.
  • Account Locked/Deactivated - If the kainossmart-intsysuser account has been locked/deactivated, it will need to have its access restored.
  • Authentication Policy Changes - If any changes have been made to the Authentication Policy (if applicable), these will need to be checked and verified that the kainossmart-intsysuser's rule is still in effect.

Once the corrective action is taken, the Workday tenant in Smart will update to show as Successfully Configured, and will again be available for testing.

Reset Password

If for any reason kainossmart-intsysuser password has been/is required to be changed, the Reset Password functionality can be used to allow Smart to safely set and store a new secure password for the kainossmart-intsysuser account.

To initiate a password reset, navigate to Workday Tenant Configurations screen and click the Reset Password link beside the Workday tenant, which you would like to reset the password for.

At this point, Smart will ask for suitable credentials to use that will allow for resetting kainossmart-intsysuser password.

Once the process is completed, the Workday tenant status will update to Successfully Configured, and will again be available for testing.