Integrations

ServiceNow Workday Integration Guide

advancedUsername/Password with Workday Integration System UserWorkday

The ServiceNow Workday integration enables organizations to synchronize employee data, automate HR workflows, and maintain consistent organizational structure between their HRIS system and ServiceNow platform. This integration solves critical business challenges around employee lifecycle management, ensuring accurate user provisioning, automated onboarding and offboarding processes, and real-time organizational hierarchy updates. HR teams, IT administrators, and service delivery managers rely on this integration to eliminate manual data entry and reduce time-to-productivity for new hires. The integration supports bidirectional data flows with Workday serving as the system of record for employee data, while ServiceNow triggers automated workflows based on Workday events such as new hires, terminations, and position changes. Primary automation patterns include scheduled data synchronization and real-time webhook processing, implemented through the HR Service Delivery application with supporting Integration Hub flows and custom scripted REST APIs.

Prerequisites

  • ServiceNow San Diego release or later with HR Service Delivery application installed
  • Integration Hub Professional license with available flow execution capacity
  • Workday tenant with HR and Security administrative access
  • Workday Web Services access with appropriate domain security permissions
  • ServiceNow admin role and hr_admin role for configuration
  • MID Server deployed in network with access to Workday endpoints
  • Valid SSL certificates configured for secure communications

Architecture Overview

The ServiceNow Workday integration utilizes the official HR Service Delivery Workday connector spoke within Integration Hub, which provides pre-built actions for common HR operations. Authentication is established using Workday Web Services credentials stored in ServiceNow Connection and Credential Aliases, supporting both username/password and certificate-based authentication methods. Data flows primarily from Workday to ServiceNow through scheduled Integration Hub flows that query Workday Web Services APIs, with ServiceNow triggering automated workflows based on received employee data changes. A MID Server is required to facilitate secure communication between ServiceNow and on-premises Workday instances, though cloud-hosted Workday tenants can connect directly through ServiceNow's cloud infrastructure. Rate limiting considerations include Workday's API throttling mechanisms which typically allow 1000 requests per hour per integration user, requiring careful flow scheduling and batch processing implementation.

Sourdough
Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher
Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview
Tasks
CMDB
API
Metrics
Monitor
Internals
Instance:sourdoughdev·Version:Yokohama
Instance StateONLINE
System StatusFully Operational
Session Timeout90 minutes
Logged-In Sessions2 (20 active)
Build Nameyokohama-12-18-2024_p1
IP Address10.159.128.43
Instance HealthHealth Score: 90%
🔥 5dSourdough (Chrome Plugin)Dark Mode

Implementation Steps

1

Create Workday Integration System User and configure Web Services access

Navigate to Workday and create a dedicated Integration System User with appropriate security group membership for HR data access. Configure the user with Web Services permissions including Worker Data, Organization Data, and Position Management domains. Generate and securely store the integration user credentials as these will be used for all API communications. Ensure the user account has sufficient permissions to read employee records, organizational hierarchy, and position data while maintaining principle of least privilege.

2

Configure Connection and Credential Aliases in ServiceNow

Navigate to Connections & Credentials > Credentials and create a new Basic Auth credential record with your Workday integration user details. Set the credential name as 'Workday_Integration_Creds' and populate the User name and Password fields with your Workday integration system user credentials. Next, navigate to Connections & Credentials > Connection Aliases and create a connection alias named 'Workday_Connection' pointing to your Workday tenant URL (typically https://wd2-impl-services1.workday.com). Associate the credential alias with the connection alias to enable authenticated communications.

3

Install and configure the HR Service Delivery Workday connector spoke

Navigate to System Applications > All Available Applications > All and search for 'Workday' to locate the official Workday Integration Hub spoke. Install the spoke which provides pre-built actions including Get Workers, Get Organizations, and Get Positions. After installation, navigate to Process Automation > Flow Designer and verify the Workday spoke appears in the available actions list. Configure the spoke's connection settings to use your previously created connection alias, ensuring proper authentication context for all Workday API calls.

4

Create employee data synchronization flow using Integration Hub

Navigate to Process Automation > Flow Designer and create a new flow named 'Workday Employee Sync'. Configure the flow trigger as a scheduled job running every 4 hours to balance data freshness with API rate limits. Add the Workday 'Get Workers' action and configure it to retrieve all active employees with their employment details, contact information, and organizational assignments. Include proper error handling and logging mechanisms to track synchronization status and identify any failed record processing.

ServiceNow Script
// Configure the Get Workers action data pills
// In the Flow Designer action configuration:
{
  "workers_request": {
    "Worker_Request_Criteria": {
      "Exclude_Inactive_Workers": true,
      "Exclude_Contingent_Workers": false
    },
    "Response_Group": {
      "Include_Personal_Information": true,
      "Include_Employment_Information": true,
      "Include_Organizations": true
    }
  }
}
5

Configure user record creation and update logic

Within your employee sync flow, add ServiceNow core actions to create or update sys_user records based on Workday employee data. Map Workday Worker ID to the employee_number field, ensure email addresses are properly synchronized, and populate manager relationships using the organizational hierarchy from Workday. Implement duplicate detection logic to prevent creation of multiple user records for the same employee, using employee_number as the unique identifier. Configure field mappings for department, title, location, and other relevant organizational attributes.

ServiceNow Script
// User record update script in Flow Designer Script step
var user = new GlideRecord('sys_user');
user.addQuery('employee_number', fd_data.lookup.workday_worker_id);
user.query();

if (user.next()) {
  user.email = fd_data.lookup.workday_email;
  user.first_name = fd_data.lookup.workday_first_name;
  user.last_name = fd_data.lookup.workday_last_name;
  user.department = fd_data.lookup.workday_department;
  user.title = fd_data.lookup.workday_title;
  user.manager = fd_data.lookup.workday_manager_sys_id;
  user.active = fd_data.lookup.workday_active_status;
  user.update();
  fd_data.action_result = 'updated';
} else {
  user.initialize();
  user.employee_number = fd_data.lookup.workday_worker_id;
  user.user_name = fd_data.lookup.workday_email;
  user.email = fd_data.lookup.workday_email;
  user.first_name = fd_data.lookup.workday_first_name;
  user.last_name = fd_data.lookup.workday_last_name;
  user.active = true;
  user.insert();
  fd_data.action_result = 'created';
}
6

Implement position and organizational structure synchronization

Create a separate Integration Hub flow for synchronizing position data and organizational hierarchy from Workday. Use the Workday 'Get Organizations' and 'Get Positions' spoke actions to retrieve current organizational structure and position details. Map Workday supervisory organizations to ServiceNow departments and cost centers, ensuring proper parent-child relationships are maintained. Configure the flow to handle organizational changes such as department restructuring, position eliminations, and new department creation with appropriate approval workflows where required.

ServiceNow Script
// Department synchronization logic in Script step
var dept = new GlideRecord('cmn_department');
dept.addQuery('dept_head', fd_data.lookup.workday_org_id);
dept.query();

if (!dept.next()) {
  dept.initialize();
  dept.name = fd_data.lookup.workday_org_name;
  dept.dept_head = fd_data.lookup.workday_manager_sys_id;
  dept.cost_center = fd_data.lookup.workday_cost_center;
  dept.head_count = fd_data.lookup.workday_headcount;
  dept.parent = fd_data.lookup.parent_dept_sys_id;
  dept.insert();
} else {
  dept.name = fd_data.lookup.workday_org_name;
  dept.head_count = fd_data.lookup.workday_headcount;
  dept.update();
}
7

Configure onboarding and offboarding workflow triggers

Navigate to Process Automation > Flow Designer and create flows that trigger HR Service Delivery onboarding and offboarding processes based on Workday employment status changes. Configure business rules on the sys_user table to detect when new employees are created or when existing employees are marked inactive. Link these triggers to HR Service Delivery case creation, automatic task assignment, and notification workflows. Ensure proper integration with ServiceNow's HR Service Portal to provide self-service capabilities for new hires and departing employees.

ServiceNow Script
// Business rule on sys_user table for onboarding trigger
(function executeRule(current, previous) {
  // Trigger when new user created with employee_number
  if (current.isNewRecord() && current.employee_number && current.active) {
    var onboardingFlow = new sn_fd.FlowAPI();
    var inputs = {
      'employee_sys_id': current.sys_id,
      'employee_number': current.employee_number.toString(),
      'start_date': current.u_start_date || gs.nowDate(),
      'department': current.department.getDisplayValue(),
      'manager_sys_id': current.manager.toString()
    };
    onboardingFlow.startFlow('hr_onboarding_process', inputs);
  }
  
  // Trigger offboarding when user becomes inactive
  if (!current.isNewRecord() && !current.active && previous.active) {
    var offboardingFlow = new sn_fd.FlowAPI();
    var inputs = {
      'employee_sys_id': current.sys_id,
      'termination_date': gs.nowDate(),
      'last_day': current.u_last_day || gs.nowDate()
    };
    offboardingFlow.startFlow('hr_offboarding_process', inputs);
  }
})(current, previous);
8

Test integration and configure monitoring and error handling

Execute your Integration Hub flows manually to verify successful connection to Workday and proper data synchronization. Navigate to Process Automation > Executions to monitor flow performance and identify any execution errors or timeouts. Configure email notifications for integration failures and set up ServiceNow Event Management to alert administrators of authentication issues or API rate limit violations. Create a dashboard using Performance Analytics to track synchronization metrics including record counts, processing times, and error rates. Implement logging mechanisms to capture detailed transaction information for troubleshooting and compliance reporting requirements.

ServiceNow Script
// Error handling and logging in flow script step
try {
  var response = request.execute();
  if (response.getStatusCode() != 200) {
    gs.error('Workday API Error: ' + response.getStatusCode() + ' - ' + response.getBody());
    
    // Create event for monitoring
    var event = new GlideRecord('em_event');
    event.initialize();
    event.source = 'Workday Integration';
    event.node = gs.getProperty('instance_name');
    event.type = 'Integration Failure';
    event.severity = 3;
    event.description = 'Failed to retrieve worker data from Workday: ' + response.getStatusCode();
    event.insert();
    
    fd_data.error_occurred = true;
    fd_data.error_message = response.getBody();
  } else {
    fd_data.worker_data = response.getBody();
    gs.info('Successfully retrieved ' + JSON.parse(response.getBody()).length + ' workers from Workday');
  }
} catch (ex) {
  gs.error('Exception in Workday integration: ' + ex.getMessage());
  fd_data.error_occurred = true;
  fd_data.error_message = ex.getMessage();
}

Common Use Cases

Automated new hire onboarding with IT provisioning

When a new employee is created in Workday, the integration automatically creates a corresponding sys_user record in ServiceNow and triggers the HR Service Delivery onboarding workflow. This workflow generates IT provisioning tasks for laptop setup, access requests for required applications, and security badge creation requests. The integration passes employee details including department, role, manager information, and start date to ensure appropriate access levels and equipment are provisioned. This automation reduces new hire time-to-productivity from days to hours while ensuring consistent security and compliance standards.

Employee termination and access revocation workflow

When an employee's status changes to terminated in Workday, the integration detects this change and automatically initiates ServiceNow's offboarding workflow within HR Service Delivery. The workflow creates tasks for IT equipment return, access rights revocation across all systems, and final security clearance processes. Manager notifications are automatically sent with checklists for knowledge transfer and project handover activities. This ensures proper security protocols are followed and reduces the risk of orphaned accounts or unreturned company assets.

Organizational hierarchy synchronization for service assignment

The integration continuously synchronizes organizational structure changes from Workday including department restructuring, manager changes, and cost center modifications. This data feeds ServiceNow's assignment rules for incident management, ensuring tickets are automatically routed to appropriate support teams based on current organizational structure. Location data from Workday also updates user records to support location-based service catalog filtering and on-site support dispatch. Real-time organizational data improves service delivery accuracy and reduces manual ticket routing efforts.

Position-based access control and role assignment

Integration of Workday position data enables ServiceNow to automatically assign roles and groups based on job titles, department assignments, and organizational hierarchy. When employees change positions within the organization, their ServiceNow access rights are automatically updated to match their new responsibilities. This includes Service Portal access levels, application-specific roles, and approval authorities for various HR and IT services. Position-based access control reduces security risks from over-privileged accounts and ensures employees have appropriate access for their current role.

Manager relationship automation for approval workflows

The integration maintains accurate manager-employee relationships in ServiceNow by synchronizing supervisory data from Workday's organizational hierarchy. This enables automatic routing of approval requests for time off, equipment purchases, training requests, and other HR services to the correct approving manager. When organizational changes occur such as manager reassignments or department transfers, approval workflows automatically update without manual intervention. Accurate manager relationships ensure efficient approval processes and proper segregation of duties for financial and administrative approvals.

Troubleshooting

HTTP 401 Unauthorized error when executing Workday Get Workers action

First verify your Integration System User credentials are correct by testing login directly in Workday. Navigate to Connections & Credentials > Credentials and update the password if it has been changed or expired in Workday. Check that the integration user has sufficient security group permissions for the Worker Data domain by reviewing Domain Security Policies in Workday. If using certificate authentication, ensure the certificate is properly uploaded to both systems and has not expired.

Integration Hub flow executes successfully but no user records are created or updated

Navigate to Process Automation > Executions and examine the flow execution details to verify data is being retrieved from Workday. Check the Transform Map configuration if using Import Sets, ensuring field mappings are correct and no transform script errors are occurring. Verify that the employee_number field mapping is properly configured as this serves as the unique identifier for user record matching. Review sys_user table ACLs to ensure the integration user context has sufficient privileges to create and update user records.

Duplicate user records created for same employee during synchronization

Review your user creation logic to ensure proper duplicate detection using employee_number as the unique identifier rather than email or name fields. Modify your Integration Hub flow to include a lookup step that queries existing sys_user records before attempting to create new ones. Implement data cleansing rules to handle variations in email formats or name spellings that might cause matching failures. Consider using GlideRecord's addNullQuery() method to handle cases where employee_number might be empty or null.

Manager relationships not properly established causing approval workflow failures

Verify that manager data is being synchronized before employee records by adjusting your flow execution order or implementing proper dependency handling. Check that manager employee_numbers in Workday correspond to existing sys_user records in ServiceNow, creating placeholder records if necessary. Review the Transform Map or script logic that populates the manager field, ensuring it performs proper user lookups and handles cases where managers might not exist in ServiceNow yet. Implement error handling to log instances where manager relationships cannot be established for later manual resolution.

Integration Hub flow execution times out when processing large employee datasets

Implement pagination in your Workday API calls by using the Response_Offset and Maximum_Results parameters in the Get Workers action configuration. Break large synchronization jobs into smaller batches of 100-200 records per execution to stay within Integration Hub execution time limits. Configure your scheduled flows to run more frequently with smaller datasets rather than attempting to process all employees in a single execution. Consider using ServiceNow's Import Set functionality for bulk data processing when dealing with initial data loads or large organizational changes.

SSL certificate validation errors when connecting to on-premises Workday tenant

Verify that your MID Server has the appropriate SSL certificates installed and trusts the certificate chain for your Workday tenant. Navigate to MID Server > Certificates and upload any required intermediate or root certificates to the MID Server's certificate store. Check MID Server logs for specific SSL handshake errors and ensure your organization's firewall allows outbound HTTPS traffic on port 443 to Workday endpoints. If using self-signed certificates, configure the MID Server to skip certificate validation only in development environments, never in production.

Pro Tips

  • Implement field-level change tracking by storing Workday's last modified timestamp in a custom field on sys_user records, allowing your integration to process only employees who have changed since the last synchronization run. This dramatically improves performance and reduces API calls when dealing with large employee datasets.
  • Create a custom Integration Hub subflow for user record upsert operations that handles common data quality issues such as duplicate email addresses, missing employee numbers, and invalid manager relationships. This reusable subflow can include data validation, cleansing rules, and standardized error handling across all your HR integration workflows.
  • Configure ServiceNow's Data Source framework to establish Workday as the authoritative source for specific user fields, preventing manual overwrites and ensuring data integrity. Use the sys_user_source table to track which integration populated each field and implement business rules to block manual changes to Workday-sourced data.
  • Leverage ServiceNow's Event Management capabilities to create comprehensive monitoring for your Workday integration by generating events for authentication failures, data quality issues, and performance thresholds. Set up automated remediation workflows that can restart failed Integration Hub flows or escalate persistent issues to integration administrators.
  • Implement a staging table approach for complex organizational data transformations by first importing Workday data into custom tables, performing data cleansing and validation, then promoting clean data to production tables. This pattern provides better error handling, rollback capabilities, and audit trails for compliance requirements.
  • Use ServiceNow's Connection and Credential Alias rotation capabilities to implement zero-downtime credential updates for Workday integration user passwords. Configure multiple credential aliases with different Workday integration users and implement automatic failover logic in your Integration Hub flows to handle credential expiration scenarios gracefully.

Known Limitations

  • Workday Web Services API enforces rate limiting of approximately 1000 requests per hour per integration user, requiring careful scheduling of synchronization flows and implementation of retry logic with exponential backoff. Large organizations may need multiple integration users or extended processing windows to handle full employee dataset synchronization.
  • Real-time bidirectional synchronization is not supported through standard Integration Hub spokes, limiting the integration to scheduled batch processing for most data flows. Critical updates like emergency terminations may require manual intervention or custom webhook implementations to achieve near real-time processing.
  • Integration Hub Professional license is required for production use of Workday integration flows, with execution capacity limits that may restrict synchronization frequency for large organizations. Flow execution timeouts of 1000 seconds limit the volume of data that can be processed in a single run, requiring pagination and batch processing strategies.
  • Complex Workday calculated fields and business process data are not easily accessible through standard Web Services APIs, potentially requiring custom integrations or additional Workday reporting solutions. Sensitive HR data like compensation details and performance ratings have restricted API access requiring elevated security permissions.
  • ServiceNow's Transform Maps used in Import Set processing have field mapping limitations when dealing with Workday's complex nested XML structures, often requiring custom scripting and manual field parsing. Multi-language employee data and Unicode character handling may require additional configuration for international organizations.

Frequently Asked Questions

Can the Workday integration handle multiple Workday tenants for merged organizations?

Yes, you can configure multiple Connection Aliases pointing to different Workday tenants and create separate Integration Hub flows for each tenant. Use tenant-specific credential aliases and implement logic to differentiate employees by adding tenant identifiers to employee numbers or email domains. Consider using ServiceNow's Domain Separation if you need to maintain completely separate user bases for different business units. The integration requires careful handling of duplicate detection across tenants and may need custom consolidation logic for shared services.

How does the integration handle Workday business process approvals and pending hires?

The standard integration focuses on active employees and may not automatically process pending hires still in Workday's business process workflows. You can configure the Get Workers action to include contingent workers and specify additional worker types, but pending hires typically require custom integration development. Consider implementing webhook listeners for Workday business process events or scheduled flows that query specific worker statuses. Pre-boarding workflows in ServiceNow can be triggered manually or through custom integrations that monitor Workday's hiring pipeline.

What happens to ServiceNow user records when employees are deleted from Workday?

Workday typically marks employees as terminated rather than deleting records, so the integration should detect status changes and deactivate corresponding ServiceNow user accounts rather than deleting them. ServiceNow best practice is to maintain historical user records for audit trails and knowledge preservation. Configure your integration flows to set user.active = false and populate termination date fields rather than using GlideRecord.deleteRecord(). You may need custom logic to handle true deletions if your Workday configuration purges old employee records.

Can the integration sync Workday custom fields and organization-specific data?

Yes, but it requires customization of the Integration Hub spoke actions and ServiceNow data model to accommodate Workday's custom fields. You'll need to modify the Get Workers action configuration to include additional Response Groups and extend ServiceNow user tables with custom fields to store the data. Workday's Web Services allow access to most custom fields through proper security configuration, but complex calculated fields or sensitive data may have access restrictions. Consider using ServiceNow's Customer Update Sets to maintain these customizations across platform upgrades.

How can I implement delta synchronization to improve performance?

Configure your Integration Hub flows to use Workday's effective date filtering and last modified timestamps to retrieve only changed records since the previous synchronization run. Store the last successful sync timestamp in ServiceNow system properties and use it as a filter in subsequent API calls to Workday. The Get Workers action supports date range filtering through Worker_Request_Criteria parameters. Implement proper error handling to reset the sync timestamp if failures occur to prevent missing updates, and consider using Workday's change tracking features for more granular delta detection.

What security considerations are important for Workday integration?

Use dedicated Integration System Users in Workday with minimal required permissions following principle of least privilege, and regularly rotate integration user passwords stored in ServiceNow credential aliases. Implement network security through MID Server placement in DMZ environments and restrict API access to specific IP ranges where possible. Enable audit logging for all integration activities and monitor for unusual API usage patterns that might indicate security breaches. Consider implementing data encryption for sensitive fields during transit and at rest, and ensure compliance with privacy regulations like GDPR for employee personal information.

How do I handle Workday maintenance windows and planned outages?

Configure your Integration Hub flows with proper error handling and retry logic to gracefully handle temporary connectivity issues during Workday maintenance windows. Use ServiceNow's scheduled job functionality to automatically reschedule failed synchronization runs and implement exponential backoff strategies to avoid overwhelming systems during recovery. Set up monitoring and alerting to distinguish between temporary maintenance outages and genuine integration failures requiring manual intervention. Consider maintaining a local cache of critical employee data in ServiceNow to support essential operations during extended Workday outages, and document escalation procedures for emergency employee changes that cannot wait for system recovery.

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue