Skip to main content

Workday IAM

This Integration is part of the Workday Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Use the Workday IAM Integration as part of the IAM premium pack. For more information, please refer to the Identity Lifecycle Management article.

Configure Workday IAM on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Workday IAM.

  3. Click Add instance to create and configure a new integration instance.

    Workday Report URLTrue
    Fetch Limit (Recommended less than 200)False
    Fetch incidentsWhether or not to fetch events from Workday report. Enable only when all required configurations are set properly.False
    Incident typeFalse
    Trust any certificate (not secure)False
    Use system proxy settingsFalse
    Mapper (incoming)Used to map Workday report entries to XSOAR indicators format.False
    Sync user profiles on first runIf checked, the first fetch won't trigger incidents but all of the User Profile indicators will be created.False
    Fetch SamplesIf checked, the fetch incidents command will sample (at most) five incidents. Use only to sample incidents for classification & mapping.False
    Date Format in Workday ReportFalse
    Deactivation date fieldSelect the field that determines when to trigger a termination incident for deactivated employees.False
    Number of days before hire date to sync hiresDetermines when employees are synced from Workday, i.e., when are the User Profile in XSOAR, and the users in the applications, created. Set to 0 to sync hires on their hire date. Leave empty to sync the hires immediately.False
    Number of days before hire date to enable Active Directory accountDetermines when to enable the Active Directory accounts of employees. Set to 0 to enable the Active Directory accounts on their hire date. Leave empty to enable the accounts immediately. Note that this is effective only when the employees are already synced to XSOAR, so you should set a number lower, or equal to, the value in the *Number of days before hire date to sync hires* parameter.False
    Source Priority LevelEvents will be fetched only for User Profiles with a Source Priority value less than or equal to the value of this parameter.False
  4. Click Test to validate the URLs, token, and connection.


You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.


Gets the report entries from Workday.

Base Command#



There are no input arguments for this command.

Context Output#

WorkdayIAM.ReportEntry.emailStringEmail address of the employee in Workday.
WorkdayIAM.ReportEntry.employeeidStringEmployee ID in Workday.
WorkdayIAM.ReportEntry.usernameStringUsername of the employee in Workday.
WorkdayIAM.ReportEntry.displaynameStringDisplay name of the employee.
WorkdayIAM.ReportEntry.locationregionStringLocation of the employee in Workday.

Command Example#


Human Readable Output#


Santa ClaraChannel Sales120100United States Of AmericaSales NAM:NAM Channel SalesRonny Rahardjorrahardjo@test.com100122RegularRonny03/25/20212245Product ManagementProduct Management Function02/15/2032Yes-HQOffice - USA - CA - HeadquartersAmericastest@test.comronnyrahardjo@test.comTrueYesWorkday IAM1California3000 Tannery WayRahardjo02/15/2032Dir, Product Line Managerrrahardjo@test.com95054
San FranciscoMagnifier Sales Inc101100United States Of AmericaWW Sales Functions:Cortex SalesStephen Arnoldsarnold@test.com101351RegularStephen03/26/20212163Software EngineeringEngineering Function02/15/2032NoOffice - USA - CA - San FranciscoAmericastest@test.comstevearnoldtstc@test.comTrueYesWorkday IAM1CaliforniaWeWork Embarcadero CenterArnold02/15/2032Mgr, SW Engineeringsarnold@test.com94111