Workday Provisioning


Okta can import users and groupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups. from Workday through its standard API. Okta supports two typical scenarios: Import from Workday and Workday-­driven IT Provisioning, as described below:


Before configuring provisioning in Okta, you need to do the following:


Known Issue:

Pre-Start Interval:

  • Setting a non-zero Pre-Start Interval will import future-dated Workday user updates ahead of time by the number of days specified. For example, a Workday provisioning group membership change that is scheduled with an effective date 2 days in the future will be reflected in Okta immediately on next import if the Pre-Start Interval value is set to 3.
  • If you require the behavior of the Pre-Start Interval to only apply to bringing in new hires and not all future dated user updates for current workers, you can do so by enabling the Early AccessEarly Access (EA) features are opt-in features that you can try out in your org by asking Okta Support to enable them. Additionally, the Features page in the Okta Admin Console (Settings > Features) allows Super Admins to enable and disable some EA features themselves. WORKDAY_VERSION29_API_UPGRADE_AND_PERFORMANCE_IMPROVEMENTS feature flag. Note that some steps in this document are slightly different if this feature is enabled.
  • The Pre-Start Interval is ignored for termination date and attribute values imported via Custom Reports. If you need to set a Pre-Start Interval for new hires, but don't want other updates to happen ahead of time, then create and import attributes from Custom Reports into Okta, instead of using the base Workday profile attributes in Okta. You can also use Group Membership Rules based off of the Custom Report attribute(s) for group assignment in Okta.