Workday
Bring your people data from Workday into MuchSkills. Your Workday team gives MuchSkills read-only access, and we map the fields and run the sync. The set-up is part of your MuchSkills implementation.
- Who
- Your Workday administrator or partner, with our CTO
- How it connects
- Custom set-up, part of your implementation
- Sync
- Every 5 hours, or on demand with Sync Now
- Access
- Read-only
How to
How it works
MuchSkills reads from Workday on a schedule. New starters, leavers, manager changes and department changes arrive at the next sync, with no manual work on either side. Nothing is written back to Workday.
Before you start
- A Workday administrator on your side, or your Workday implementation partner.
- A list of who should be in MuchSkills: everyone, or a selection by country, legal entity or worker type.
- Your field names. Workday tenants name custom fields differently, so have your field list to hand for the technical session.
Steps
In Workday
Your Workday administrator or partner will recognise these tasks. MuchSkills reads custom reports that you enable as web services, often called Reports as a Service (RaaS). The exact domains depend on how your tenant is configured, and your partner can confirm them.
- Create an integration system user. Run Create Integration System User, give it a user name and password, and tick Do Not Allow UI Sessions. In Maintain Password Rules, add it to the system users whose passwords do not expire.
- Create a security group for it. Run Create Security Group and choose Integration System Security Group (Unconstrained). Choose Constrained instead if you want to limit access to certain organisations. Add the integration system user to the group.
- Give the group read access. In the domain security policies, give the group Get access to the domains behind the fields in your reports, typically Worker Data: Workers, Worker Data: Current Staffing Information, Worker Data: Business Title on Worker Profile and Person Data: Work Contact Information, plus the domains for photos, project allocations, leave and time off if you include them. View Security for Securable Item shows which domain secures a field.
- Activate the changes. Run Activate Pending Security Policy Changes.
- Create the custom reports. Run Create Custom Report, choose the Advanced type and tick Enable As Web Service. Create one report for each of these, with a filter for the people in scope:
Report What it returns Needed Workers Worker ID, first and last name, work email, business title, manager, department, location or country, worker type and status, including people who have left Yes Photos Worker ID and profile photo Recommended Project allocations Worker, project, start and end dates and percentage, if you plan projects in Workday Optional Leaves of absence Worker, first and last day, and percentage. Leave out the leave type Recommended Time off Worker, date and quantity. Leave out the time off type, so no reasons leave Workday Recommended - Share the reports with the integration user. On each report's Share tab, share it with the integration system user, or its security group.
- Copy each report's URL. From the report's related actions, choose Web Service › View URLs and copy the JSON link. It looks like
https://yourhost.workday.com/ccx/service/customreport2/yourtenant/owner/Report_Name?format=json. - Choose how MuchSkills signs in.
- OAuth 2.0, preferred. Run Register API Client for Integrations, tick Non-Expiring Refresh Tokens, and choose the scopes that cover the reports' data. Note the Client ID and Client Secret, and the token endpoint shown under View API Clients. Then run Manage Refresh Tokens for Integrations for the integration system user and generate a refresh token.
- User name and password. MuchSkills signs in as the integration system user from step 1.
- Allow our addresses, if you restrict by IP. If your tenant limits web service access by IP address, add
13.51.77.53and16.170.107.61.
With MuchSkills
- Send us the connection details. The report URLs, and either the client ID, client secret, token endpoint and refresh token, or the integration user's credentials, with your field list and scope, through a secure channel we agree.
- Join the technical session. Your Workday administrator and our CTO map the fields and test the connection together.
- Check a first sync. We sync a handful of people or one department. You check their names, managers, departments, photos and any tags in MuchSkills.
- Widen the scope. We switch the sync on for everyone in scope. From then on it runs every 5 hours.
Check it worked
- Team/Org › Members lists the people in scope.
- The people in scope have an invitation to create their MuchSkills profile.
- Managers see their direct reports in My Circle.
Benefits
What you get
- Workday stays the source of truth. People data is entered once, in Workday, and MuchSkills follows.
- A skills layer on your HCM. Skills, certifications and project history sit next to the people records you already trust.
- Clean data for planning. Reporting lines, departments and tags arrive ready for filtering, gap analysis and Team Builder.
Important to know
Important to know
What syncs. Only email and name are required. Sync as many of the other fields as you can, because each one makes MuchSkills more useful.
| Field | Needed | Used for |
|---|---|---|
| First and last name | Required | Profiles, search, every view |
| Required | Matching and sign-in. Must be the address people sign in with | |
| Job title | Recommended | Profiles, roles, Discover |
| Manager | Recommended | Reporting lines, My Circle, reports. Include the manager's worker ID or work email in the Workers report, and MuchSkills maps it |
| Department | Recommended | Departments and filters |
| Employee status | Recommended | Deactivating leavers |
| Location or country | Recommended | Filters and scoping |
| Profile photo | Recommended | Profiles and the org chart |
| Worker type | Recommended | Filtering, for example employee or contractor |
| Absence | Recommended | Availability in Team Builder and My Circle. Dates and percentages only |
| Other fields | Optional | Any field can become a filterable tag, for example legal entity, team or cost centre. Agree them with us first |
Data MuchSkills does not accept. These are blocked when data arrives and never stored, even if the source includes them: age or date of birth, salary or other compensation data, performance ratings, and political, religious or health data.
Who is included. Filtering in Workday is the preferred way, so nothing outside your scope leaves your tenant. The fallback is a country filter in MuchSkills; records outside it are ignored and not stored. Your security or compliance team decides which fits your rules.
Leavers are deactivated, not deleted. Project history and certificates stay on record. Include people who have left in the Workers report, with their status, so MuchSkills sees when someone leaves.
Our IP addresses. MuchSkills always connects from the same two addresses: 13.51.77.53 and 16.170.107.61.
Common errors
Troubleshooting
| What you see | Why | What to do |
|---|---|---|
| Some people are missing | They fall outside the security group's access, or outside the report's filter | Check the constrained group's organisations and the report's filter |
| A report returns an error or no rows | The report is not shared with the integration user, is not enabled as a web service, or the group lacks access to a field's domain | Check the report's Share tab and Enable As Web Service, and run View Security for Securable Item on the missing fields |
| Managers are missing or wrong | The Workers report has no manager column, or the manager is outside the report's filter | Add the manager's worker ID or work email, and include managers in scope |
| A person appears twice | Their Workday email differs from the address they signed up with | Align the email, then tell us which profile to keep |
| The sync stopped | The refresh token was revoked, the integration user's password expired, or the user was disabled | Generate a new refresh token or reset the password, and send it to us securely |
| The connection is refused | Your tenant limits web service access by IP address | Add 13.51.77.53 and 16.170.107.61 to the allow list |
Frequently asked questions
Workday shows as Contact us in MuchSkills. Can we still connect it?
Yes. Workday is set up with us rather than from a form, because every Workday tenant is configured differently. Email support@muchskills.com or use the chat, and we book the technical session.
Do we need middleware or an integration platform?
No. MuchSkills reads directly from Workday over HTTPS. Your team only creates the integration user, its permissions and a few custom reports enabled as web services.
Which reports do we create?
Separate custom reports for workers, photos, project allocations, leaves of absence and time off. Workers is the one you need; the others are optional and add photos, project time and availability. Each one is enabled as a web service and shared with the integration user.
OAuth or a user name and password?
Either. We prefer OAuth 2.0: you register an API client and generate a refresh token for the integration system user. An integration system user with a user name and password works too.
Can we leave out some countries or legal entities?
Yes. The preferred way is to filter in Workday, so only people in scope ever leave your tenant. If that is not possible, MuchSkills can filter by country as records arrive and ignore the rest without storing them.
Can we test with a few people first?
Yes. The first sync can be limited to a handful of people or one department. You check the result, then we widen the scope. We do not connect to Workday test tenants.
How often does it sync?
Every 5 hours. An Owner or Admin can also run a sync at any time with Sync Now.
What happens to people who leave?
They are deactivated at the next sync, never deleted. Their project history and certificates stay on record, which matters for compliance.
Do you import absence reasons?
No. If you sync absence, MuchSkills takes only the dates and the percentage of time away. Reasons such as sick leave are never imported.
How do we send the credentials safely?
Through a secure channel we agree with you in advance, such as a password manager share. Never by plain email.