Smart - Customer Knowledge BaseSmart - User Guide ConfigurationProvisioning Workday tenants for Smart - Self Service Provisioning (SSP)

Provisioning Workday tenants for Smart - Self Service Provisioning (SSP)

Smart can execute tests against any non-Production Workday tenant. Connecting Workday tenant to Smart requires applying specific configuration on your Workday tenant - at a high level this includes:

  • A Smart Integration System User
  • A Security Group with specific Domain Security Policies
  • Updating Business Process Security Policies to allow Smart to Cancel and Rescind transactions via web service
  • Custom Reports and Calculated Fields

Configuration process is known as Self Service Provisioning (SSP) and can be automated by a single button click from within the customer’s Smart tenant.

If you are already live with Workday, you can benefit from automated re-provisioning of your testing Workday tenants for Smart. Partially configuring your Production Workday tenant for Smart will result in testing Workday tenants being automatically re-configured for Smart each time they are refreshed from Production.

If you would like to have your Workday tenant provisioned for Smart, please contact the Kainos Smart Onboarding or Kainos Smart Support team for more information.

Smart Workday Tenant Requirements

During Onboarding, initial tenant setup and Support, the Kainos Smart Onboarding or Kainos Smart Support team will require access to your Workday tenant(s), to apply configuration and enable Smart to execute tests against them. To fulfill this, a member of the Kainos Smart Onboarding or Kainos Smart Customer Support team should be setup with a named user account on your Workday tenant(s).

As a minimum we recommend one named user from Kainos Smart Onboarding or Kainos Smart Support team being set up with access to apply Smart configuration to a Workday tenant. However, we advise that additional users from the Kainos Smart Onboarding or Kainos Smart Support team are also created, to ensure that your use of Smart can be supported more effectively. 

Kainos recommends that customers create an Implementer Account for the Kainos Named User e.g. jsmith-impl.

Alternatively, if granting implementer access is not possible, customers can grant required access by following these steps:

  1. Create a named, Integration System User e.g. jsmith-smart
  2. Create new Integration System Security Group (Unconstrained) called Kainos Smart Users
  3. Grant Domain Security permissions listed below (required set of permissions to launch SSP):
Policy View Modify Get Put
Security Administration FALSE TRUE FALSE FALSE
Security Configuration FALSE TRUE FALSE FALSE
Business Process Administration TRUE FALSE FALSE FALSE
Set Up: Tenant Setup - HCM FALSE TRUE FALSE FALSE
Integration Security FALSE TRUE FALSE FALSE
Workday Accounts FALSE TRUE FALSE FALSE
Custom Report Creation FALSE TRUE FALSE TRUE
Configuration Set: Custom Reports and Fields FALSE FALSE FALSE TRUE
Manage: All Custom Reports FALSE FALSE FALSE TRUE
Security Activation FALSE TRUE FALSE FALSE

If customers are live with Workday, it is recommended that this access is created in the Production environment, so it automatically propagates to any testing Workday tenants refreshed from Production Workday tenant. 

In addition, an Authentication Policy blocking Smart access should be set up in your Production Workday tenant. For more information on the creation of this Authentication Policy, please see the section on Workday Authentication Policies.

It is also recommended to configure Proxy Access Policy for Kainos users to proxy on behalf of All Users Security Group, so Kainos users can proxy in testing Workday tenant.

Configuring non-Production Workday tenants for Smart

Users with implementer or equivalent level of access (please refer to Smart Workday Tenant Requirements section for required permissions to initiate SSP) to their Workday tenant will have the option of launching the SSP process on testing Workday tenants, described in the Launching SSP on a New Test Tenant section.

SSP will apply the following configuration on the non-Production Workday tenant:

  • Maintain User Name Rules to ensure the user name length is 22 characters or more - required to create the Smart System User.
  • Create Integration System User called "kainossmart-intsysuser"
  • Create a single Integration System Security Group (Unconstrained):
    • Kainos Smart Permissions Group

with the following permissions:

Policy View Modify Get Put
Worker Data: Compensation Grade TRUE FALSE TRUE FALSE
Business Process Administration FALSE TRUE TRUE FALSE
Worker Data: Benefit Eligibility TRUE FALSE TRUE FALSE
Person Data: Birth Place TRUE FALSE TRUE FALSE
Worker Data: Business Title on Worker Profile TRUE FALSE TRUE FALSE
Person Data: ID Information TRUE FALSE TRUE FALSE
Worker Data: International Assignments TRUE FALSE TRUE FALSE
Worker Data: Payroll (Pay Group Specific) TRUE FALSE TRUE FALSE
Worker Data: Payroll Interface (Pay Group Specific) TRUE FALSE TRUE FALSE
Worker Data: Payroll Interface (Tax Elections) TRUE FALSE TRUE FALSE
Worker Data: Worker Summary Reports TRUE FALSE FALSE FALSE
View: Business Asset TRUE FALSE TRUE FALSE
Reports: Business Assets TRUE FALSE TRUE FALSE
Custom Report Administration FALSE TRUE FALSE TRUE
Custom Report Creation FALSE TRUE FALSE TRUE
Integration Process FALSE FALSE FALSE TRUE
Integration Reports FALSE TRUE FALSE TRUE
Manage: Address Information TRUE FALSE TRUE FALSE
Integration Build TRUE FALSE TRUE FALSE
Manage Pre-Hire Process: Consider Pre-Hires TRUE FALSE TRUE FALSE
Manage: Supervisory Organization TRUE FALSE TRUE FALSE
Reports: Manager TRUE FALSE TRUE FALSE
Reports: Manager (Pre-Hire) TRUE FALSE TRUE FALSE
Search: Find Worker TRUE FALSE TRUE FALSE
Set Up: Base and Plan TRUE FALSE TRUE FALSE
Set Up: Leave of Absence TRUE FALSE TRUE FALSE
Worker Data: Active and Terminated Workers TRUE FALSE TRUE FALSE
Worker Data: All Positions TRUE FALSE TRUE FALSE
Worker Data: Beneficiaries and Dependents TRUE FALSE TRUE FALSE
Worker Data: Compensation by Organization TRUE FALSE TRUE FALSE
Worker Data: Compensation Summary by Job Profile TRUE FALSE TRUE FALSE
Worker Data: Current Staffing Information TRUE FALSE TRUE FALSE
Person Data: Date of Birth TRUE FALSE TRUE FALSE
Person Data: Disabilities TRUE FALSE TRUE FALSE
Worker Data: Add Worker Documents TRUE FALSE TRUE FALSE
Person Data: Emergency Contacts TRUE FALSE TRUE FALSE
Worker Data: Employee Contracts TRUE FALSE TRUE FALSE
Person Data: Gender TRUE FALSE TRUE FALSE
Person Data: Home Address TRUE FALSE TRUE FALSE
Worker Data: Leave of Absence TRUE FALSE TRUE FALSE
Worker Data: Public Worker Reports TRUE FALSE TRUE FALSE
Person Data: Religion TRUE FALSE TRUE FALSE
Worker Data: Retirement Savings TRUE FALSE TRUE FALSE
Worker Data: Stock Grants TRUE FALSE TRUE FALSE
Worker Data: Talent TRUE FALSE TRUE FALSE
Worker Data: Terminations TRUE FALSE TRUE FALSE
Person Data: Work Address TRUE FALSE TRUE FALSE
Person Data: Work Email TRUE FALSE TRUE FALSE
Person Data: Work Instant Messenger TRUE FALSE TRUE FALSE
Person Data: Work Phone TRUE FALSE TRUE FALSE
Worker Data: Work Shifts TRUE FALSE TRUE FALSE
Person Data: Work Web Address TRUE FALSE TRUE FALSE
Business Process Delegation FALSE TRUE TRUE FALSE
Configuration Set: Custom Reports and Fields FALSE FALSE FALSE TRUE
Manage: All Custom Reports FALSE TRUE FALSE TRUE
Workday Accounts FALSE TRUE FALSE TRUE
Academic Units: View TRUE FALSE TRUE FALSE
Appointee Data: Current Appointments TRUE FALSE TRUE FALSE
Audit: Contact Information TRUE FALSE FALSE FALSE
Business Process Reporting TRUE FALSE FALSE FALSE
Candidate Data: Background Check History TRUE FALSE TRUE FALSE
Compensation Change: Total Base Pay TRUE FALSE TRUE FALSE
Job Information TRUE FALSE TRUE FALSE
Job Requisition Data TRUE FALSE TRUE FALSE
Manage Pre-Hire Process: Manage Pre-Hires TRUE FALSE TRUE FALSE
Manage Pre-Hire Process: Pre-Hire Eligibility TRUE FALSE TRUE FALSE
Manage: Company TRUE FALSE FALSE FALSE
Manage: Location TRUE FALSE FALSE FALSE
Manage: Organization Roles TRUE FALSE TRUE FALSE
Pre-Hire Data: Background Check Status TRUE FALSE TRUE FALSE
Reports: Open Positions TRUE FALSE TRUE FALSE
Set Up: Benchmark Jobs TRUE FALSE TRUE FALSE
Set Up: Organization TRUE FALSE TRUE FALSE
Set Up: Stock TRUE FALSE TRUE FALSE
Set Up: Time Off (Calculations - Absence Specific) TRUE FALSE TRUE FALSE
Worker Data: Active Employees TRUE FALSE FALSE FALSE
Worker Data: Background Check Status TRUE FALSE TRUE FALSE
Worker Data: Benefit Elections TRUE FALSE TRUE FALSE
Worker Data: Benefits TRUE FALSE TRUE FALSE
Person Data: Citizenship Status TRUE FALSE TRUE FALSE
Worker Data: Collective Agreements TRUE FALSE TRUE FALSE
Worker Data: Contingent Worker Assignment Details TRUE FALSE TRUE FALSE
Person Data: Ethnicity TRUE FALSE TRUE FALSE
Worker Data: Funded Plan Assignments TRUE FALSE TRUE FALSE
Worker Data: Headcount Reports TRUE FALSE TRUE FALSE
Worker Data: Historical Staffing Information TRUE FALSE TRUE FALSE
Person Data: Home Email TRUE FALSE TRUE FALSE
Person Data: Home Instant Messenger TRUE FALSE TRUE FALSE
Person Data: Home Phone TRUE FALSE TRUE FALSE
Person Data: Home Web Address TRUE FALSE TRUE FALSE
Person Data: Marital Status TRUE FALSE TRUE FALSE
Worker Data: Market Position Details TRUE FALSE TRUE FALSE
Person Data: Medical Exams TRUE FALSE TRUE FALSE
Person Data: Military Status TRUE FALSE TRUE FALSE
Worker Data: Payroll (Company Specific) - USA TRUE FALSE TRUE FALSE
Worker Data: Payroll (Costing Override) TRUE FALSE FALSE FALSE
Worker Data: Payroll Interface (Costing Overrides) TRUE FALSE FALSE FALSE
Worker Data: Performance Reviews TRUE FALSE TRUE FALSE
Worker Data: Period Activity Pay TRUE FALSE TRUE FALSE
Worker Data: Probation Periods TRUE FALSE TRUE FALSE
Worker Data: Retirees TRUE FALSE FALSE FALSE
Worker Data: Staffing TRUE FALSE FALSE FALSE
Worker Data: Staffing Reports with Compensation Data TRUE FALSE FALSE FALSE
Worker Data: Time Off (Time Off) TRUE FALSE TRUE FALSE
 Set Up: Contact Info, IDs, and Personal Data FALSE TRUE FALSE FALSE
Process: I-9 Forms - USA FALSE FALSE TRUE FALSE
Worker Data: I-9 Forms - USA FALSE FALSE TRUE FALSE
Find Candidates: Internal and External FALSE FALSE TRUE FALSE
Worker Data: Unions FALSE FALSE TRUE FALSE
Person Data: Nationalities FALSE FALSE TRUE FALSE
Talent Pool: View and Edit TRUE FALSE FALSE FALSE
Worker Data: Succession TRUE FALSE FALSE FALSE
Worker Data: Calibration TRUE FALSE FALSE FALSE
Worker Data: Employee Reviews TRUE FALSE FALSE FALSE
Worker Data: Compensation Management by Organization TRUE FALSE FALSE FALSE
Worker Data: Business Assets TRUE FALSE FALSE FALSE
Worker Data: Payroll (Payment Elections) TRUE FALSE FALSE FALSE
Custom Label Management FALSE FALSE TRUE FALSE
Reports: Financial Accounting TRUE FALSE FALSE TRUE
Reports: Customer Accounts TRUE FALSE TRUE FALSE
Reports: Supplier Accounts TRUE FALSE TRUE FALSE
Process: Journals (NEW) TRUE FALSE FALSE TRUE
Process: Journals - View TRUE FALSE FALSE TRUE
Process: Supplier Invoice TRUE FALSE FALSE FALSE
Integrations: Workfeed TRUE FALSE TRUE FALSE
Process: Receipt TRUE FALSE FALSE FALSE
Process: Requisition TRUE FALSE FALSE FALSE
Process: Supplier Contract (NEW) TRUE FALSE FALSE FALSE
Reports: Supplier TRUE FALSE TRUE FALSE
View: Supplier TRUE FALSE FALSE FALSE
Set Up: Credit Card TRUE FALSE FALSE FALSE
Worker Data: Veteran Status Identification TRUE FALSE FALSE FALSE
Recruiting Agency Careers TRUE FALSE FALSE FALSE
Job Requisitions for Recruiting TRUE FALSE FALSE FALSE
Process: Supplier Invoice - Reporting FALSE FALSE FALSE TRUE
Process: Customer Invoice Payment TRUE FALSE FALSE FALSE
View: Customer TRUE FALSE FALSE FALSE
Process: Customer Contract TRUE FALSE FALSE FALSE
Process: Project Billing TRUE FALSE FALSE FALSE
Configuration Set: Business Processes FALSE FALSE TRUE FALSE
Business Process Definition View FALSE FALSE TRUE FALSE
Manage: Organization Integration FALSE FALSE TRUE FALSE
Reports: Supplier Accounts 1099 TRUE FALSE FALSE FALSE
Process: Expense Report TRUE FALSE FALSE FALSE
Process: Spend Authorization TRUE FALSE FALSE FALSE
Manage: Service Center TRUE FALSE FALSE FALSE
Set Up: Payroll - Pay Group Specific TRUE FALSE FALSE FALSE
Worker Data: Time Off (Time Off Balances) TRUE FALSE FALSE FALSE
Set Up: Payroll (Calculations - Payroll Specific) TRUE FALSE FALSE FALSE
Process: Customer Invoice - Change TRUE FALSE FALSE FALSE
Process: Customer Invoice - View TRUE FALSE FALSE FALSE
Security Administration FALSE TRUE FALSE FALSE
Security Configuration TRUE FALSE FALSE FALSE
Process: Expense Report - View TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results (Results - Security based on Pay Component Security) TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results (Results - Reports based on Pay Component Security) TRUE FALSE FALSE FALSE
Process: Ad Hoc Payment - View TRUE FALSE FALSE FALSE
Process: Purchase Order - Reporting TRUE FALSE FALSE FALSE
Process: Requisition - View FALSE FALSE TRUE FALSE
Process: Purchase Order TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Worker (Results) TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Worker (Payslips) TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) - USA TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) - CAN TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) - FRA TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) - UK TRUE FALSE FALSE FALSE
Reports: Pay Calculation Results for Pay Group (Results) TRUE FALSE FALSE FALSE
Process: Customer Contract - View TRUE FALSE FALSE FALSE
Worker Data: Payroll (Payroll Input) FALSE FALSE FALSE TRUE
Run Batch Calculations (Pay Calculation) FALSE FALSE FALSE TRUE
Process: Spend Authorization - View TRUE TRUE FALSE FALSE
Process: Receipt/Return - View TRUE TRUE FALSE FALSE

Job Postings: External

FALSE FALSE TRUE FALSE
Candidate Data: Job Application
FALSE FALSE TRUE TRUE

Access Ledger Account (Segmented)

TRUE FALSE FALSE FALSE
Process: Business Asset Accounting
TRUE FALSE TRUE FALSE
Process: Purchase Order - View
TRUE FALSE FALSE FALSE
  • Add Kainos Smart Permissions Group to Cancel and Rescind web service Actions for the following Business Processes:
Business Process Type Cancel (Web Service) Rescind (Web Service)
Add Academic Appointment Y Y
Add Additional Job Y Y
Add Retiree Status Y Y
Assign Costing Allocation Y Y
Assign Employee Collective Agreement Y Y
Assign Pay Group Y Y
Assign Pay Group for Position Restrictions Event Y Y
Assign Roles Y Y
Assign Superior Y Y
Background Check Y Y
Change Benefit Jobs Y Y
Change Benefits Y Y
Change Benefits for Life Event Y Y
Change Default Compensation Y Y
Change Emergency Contacts Y Y
Change Job Y Y
Change Organization Assignments for Worker Y Y
Complete Federal Withholding Elections Y Y
Complete Form I-9 Y N
Correct Time Off Y N
Create Position Y Y
Create Workday Account Y Y
Edit Government IDs Y Y
Edit ID Information Y Y
Edit Licenses Y Y
Edit Other IDs Y Y
Edit Position Y Y
Edit Position Restrictions Y Y
Employee Contract Y Y
End Academic Appointment Y Y
Evergreen Requisition Y Y
Freeze Position Y Y
Hire Y Y
Hiring Restrictions  Y  Y
Edit Hiring Restrictions  Y  Y
Job Requisition Y Y
Manage Probation Period Y Y
Onboarding Y N
Passports and Visa Change Y Y
Period Activity Pay Y Y
Personal Information Change Y Y
Propose Compensation Hire N Y
Propose Compensation Change N Y
Remove Retiree Status Y Y
Request Compensation Change Y Y
Request Delegation Change Y N
Request Leave of Absence Y Y
Request One-Time Payment Y Y
Request Return from Leave of Absence Y Y
Request Stock Grant Y Y
Request Time Off Y N
Review COBRA Eligibility Event Y Y
Service Dates Change Y Y
Termination Y Y
Update Academic Appointment Y Y
Create Subordinate Y Y
Service Dates Change Y Y
End International Assignment Y Y
Start International Assignment Y Y
Switch Primary Job Y Y
Assign Work Schedule Y Y
Contract Contingent Worker Y Y
Contact Change Y Y
Dependent Event Y Y
Complete Federal Withholding Elections Y Y
Complete State and Local Withholding Elections Y Y
End Contingent Worker Contract Y Y
Severance Worksheet Y Y
Manage Education Y Y
Edit Workday Account Y Y
Union Membership Event Y Y
End Additional Job Y Y
Assign Matrix Organization Y Y
Home Contact Change Y Y
Work Contact Change Y Y
Close Position Y Y
Job Application Y Y
  • Add kainossmart-intsysuser to Kainos Smart Permissions Group
  • Edit Password Rules and set following values to 0:
    • Days Before Password May Be Re-used
    • Number of Passwords before Password Reuse
  • Set kainossmart-intsysuser Preferred Locale and Preferred Language to English (United States) – en_US
  • Activate Pending Security Policy Changes
  • Upload Smart Calculated Fields and Custom Reports, which are required for Smart to operate on a customer Workday tenant.

Upon SSP completion, the Proxy Access Policy should be configured in order to allow Smart to proxy on behalf of All Users Security Group.

If there is an Authentication Policy enabled, it should be updated to allow Kainos Smart to access the Workday tenant.

If required, Kainos Smart IP addresses should be whitelisted to allow Smart to interact with Workday tenant.

Please reach out to Kainos Smart Onboarding or Kainos Smart Support team for more information on Kainos Smart IP addresses.

Testing Workday tenant provisioned for Smart might have one of the following statuses:

  • Successfully Configured - indicating that testing Workday tenant was successfully provisioned for Smart.
  • Configuration Missing - indicating that testing Workday tenant was provisioned for Smart, however it is missing Smart configuration as potentially it might have been refreshed. To re-initiate the SSP process, please refer to Re-launching SSP section.
  • Cannot Login - indicating that Smart cannot login to testing Workday tenant. Please refer to Cannot Login section for more information on the potential reasons and resolution.
  • Cannot Connect - indicating that Smart cannot connect to testing Workday tenant. Testing Workday tenant URL and endpoint should be checked on Workday Tenant Configuration - Edit Test Tenant screen.

Launching SSP on a New Test Tenant

1. First, select the Workday Tenants option from the Smart ADMIN menu.

This will bring you to the Workday Tenant Configurations screen, with section for Production and Test Workday Tenants.

2. From the Test Tenants section, select Create NewThis will present the user with a Tenant Configuration screen (please refer to Creating a New Workday Tenant section for more details):

When all details have been correctly entered, select Apply Configuration. The following prompt will appear:

At this point, users can enter their implementer or equivalent credentials and select Verify. Smart will use these credentials to initiate the provisioning  and present a Provisioning Run Details page providing information on the Self Service Provisioning process progress. More information on the required permissions is available by clicking What is an equivalent level of access? This will display a list of Domain Security Policies Permissions that are necessary to successfully complete the Provisioning process (please refer to Smart Workday Tenant Requirements section for more details).

Upon SSP initialization the Provisioning Run Details page will be displayed listing the Smart Provisioning tasks.

Opening Provisioning Tasks will provide more details on configuration applied by Smart in the Workday tenant.

If Email Notification is enabled for Smart user who initiated SSP process, then upon provisioning completion they will receive a summary email to their email address.

If you wish for a member of the Kainos Smart Onboarding or Kainos Smart Support team to carry out the process of adding a new tenant, they will need to be granted named user access on the relevant Workday tenant, as well as the necessary security permissions to carry out the process (please refer to Smart Workday Tenant Requirements section for more details). Please contact the Kainos Smart Onboarding or Kainos Smart Support team for further information.

Re-launching SSP

If users wish to re-configure their tenants after a weekly refresh, it is simply a matter of navigating to the Workday Tenant Configurations page and selecting Edit beside the tenant which needs to have the configuration re-applied.

The Tenant Configuration screen will be presented, along with an option to Retry the provisioning process. At this point the Workday Credentials screen shown above will prompt the user for valid credentials, which will be used to re-execute the SSP process. Once again, when completed, the initiating user will receive a summary email to their email address (providing Email Notification is enabled).

Cannot Login

If your Workday tenant status in Smart is set to Cannot Login, and the Workday tenant in question has not had a refresh, this is indicative that the kainossmart-intsysuser account exists, however Smart cannot currently log in to the Workday tenant.

This can be caused by the following:

  • Account Expiry - If it has been a while since the kainossmart-intsysuser account was created the account may have expired, and will need to have either its expiry date extended, or an expiry exemption put in place.
  • Account Locked/Deactivated - If the kainossmart-intsysuser account has been locked/deactivated, it will need to have its access restored.
  • Authentication Policy Changes - If any changes have been made to the Authentication Policy (if applicable), these will need to be checked and verified that the kainossmart-intsysuser's rule is still in effect.
  • IP Whitelisting Changes - If any changes have been made to the IP Whitelisting (if applicable), these will need to be checked and verified that the Kainos Smart IP addresses are still whitelisted.

Once the corrective action is taken, the Workday tenant in Smart will update to show as Successfully Configured or Configuration Missing.

Automated re-provisioning of testing Workday Tenants - partially configuring a Production Workday tenant for Smart

If you are live with Workday you can automate the re-provisioning process of your testing Workday tenants, by conducting partial, manual provisioning of your Production Workday tenant for Smart and adding it to your Smart tenant. Please note that Smart will not be able to run any tests against Production Workday tenant.

Once Production Workday tenant is added to Smart, testing Workday tenants available in Smart tenant will be automatically re-provisioned upon weekly refresh. Re-provisioning process is initiated by a scheduled Test Run execution.

Partially configuring Production Workday tenants for Smart

Following Smart configuration should be applied on Production Workday tenant:

  • Maintain User Name Rules update to ensure the user name length allows 22 characters or more - required to create the Smart System User
  • Create Integration System System User called "kainossmart-intsysuser"
  • Create a single Integration System Security Group (Unconstrained):
    • Kainos Smart Permissions Group

with the following permissions:

Policy View Modify Get Put
Security Administration FALSE TRUE FALSE FALSE
Security Configuration FALSE TRUE FALSE FALSE
Security Activation FALSE TRUE FALSE FALSE
  • Add kainossmart-intsysuser to Kainos Smart Permissions Group
  • Set kainossmart-intsysuser's Preferred Locale and Preferred Language to English (United States) – en_US
  • Activate Pending Security Policy Changes


Upon partial configuration completion, the Proxy Access Policy should be configured in order to allow Smart to proxy on behalf of All Users Security Group in the testing Workday tenants.

Additionally, the Kainos Smart Authentication Policy should be configured to prevent Kainos user(s) from being able to log into the Workday Production tenant, but allow Smart to access testing Workday tenants.

If required, Kainos Smart IP addresses should be whitelisted to allow Smart to interact with Workday tenant.

Please reach out to Kainos Smart Onboarding or Kainos Smart Support team for more information on Kainos Smart IP addresses or if you require any assistance in partially configuring Production Workday tenant for Smart.


Once Production Workday tenant is partially configured for Smart it can be added to Smart tenant - please refer to Adding Production Workday tenant to Smart section for more details.

Adding Production Workday tenant to Smart

1.  Manually apply a partial Smart configuration to Production Workday tenant - please refer to
      Partially configuring Production Workday tenants for Smart section for more details.

2.  In Smart, select the Workday Tenants option from the Smart ADMIN menu. This will bring you to the
      Workday Tenant Configurations screen with two sections:

  • Production Tenant
  • Test Tenants

3.  From the Production Tenant section, select Create New. This will present the user with a Production
     Tenant Configuration screen. When all details have been correctly entered, select Apply Configuration.

4.  Enter Workday credentials to reset the kainossmart-intsyuser password on a Production Workday tenant
      and add it to Smart. If there were any testing Workday tenants already configured in Smart, they will
      automatically have kainossmart-intsyuser password reset as well and set to password set for Production
      Workday tenant.

The permission required for a Workday user to reset other user’s password is Workday Accounts (View and Modify).

Once Production Workday tenant is added to Smart it might have one of the following statuses:

  • Can Login - indicating that Production Workday tenant was successfully added to Smart, however Smart can log in to Production Workday tenant. Kainos Smart Authentication Policy should be applied on Production Workday tenant to prevent Smart from being able to access it. 
  • Cannot Login - indicating that Production Workday tenant was successfully added to Smart, however Smart can not log in to Production Workday tenant. This is expected and desired status.
  • Cannot Connect - indicating that Smart cannot connect to Production Workday tenant. Production Workday tenant URL and endpoint should be checked on Workday Tenant Configuration - Edit Production Tenant screen.

If you require any assistance in partially provisioning your Production Workday for Smart, please contact the Kainos Smart Onboarding or Kainos Smart Support team.

Refresh Process - Automatic Initiation of SSP on non-Production Workday tenants

With a Production Workday tenant configured in Smart, SSP will be automatically initiated on testing Workday tenants upon detecting that a refresh from Production Workday tenant has occurred. This check will be run when a Test Run is executed against a testing Workday tenant. Test Runs can be scheduled in advance to execute at a time when your Sandbox tenant will have been refreshed, allowing test runs to execute without the need to manually monitor your Smart tenant.

If there was no Test Run scheduled to initiate SSP upon testing Workday tenant refresh, then user will be asked to initiate SSP manually - please refer to Re-launching SSP section for more details.

Reset Password

If for any reason kainossmart-intsysuser password has been/is required to be changed, the Reset Password functionality can be used to allow Smart to safely set and store a new secure password for the kainossmart-intsysuser account.

To initiate a password reset, navigate to Workday Tenant Configurations screen and click the Reset Password link beside the Workday tenant, which you would like to reset the password for.

At this point, Smart will ask for suitable credentials to use that will allow for resetting kainossmart-intsysuser password.

Once the process is completed, the Workday tenant status will update to Successfully Configured, and will again be available for testing.


In case Production Workday tenant is configured in Smart:

  • resetting password on Production Workday tenant will initiate password reset on testing Workday tenants configured in Smart. Testing Workday tenants password would be set to the Production Workday password.
  • resetting password on testing Workday tenant will reset it to Production Workday tenant password