Connect Workday HCM to Active Directory

Create an Integration System Security Group (Unconstrained) named ezOnboard. This lets the integration read every worker. You’ll add its user in the next step.

Run Maintain Permissions for Security Group. On Domain Security Policy Permissions, add the domains below with Get Only access. No Put access is needed. Run Activate Pending Security Policy Changes, add a comment and confirm to apply the permissions.

Create an integration system user named ezOnboard_ISU with a strong password. Clear Require New Password at Next Sign In, set Session Timeout Minutes to 0 and select Do Not Allow UI Sessions. Add the user to the ezOnboard group. In Maintain Password Rules, exempt it from password expiration. If your policy allows only SAML, add a rule allowing User Name Password for this group.

Save the username and password securely. Note your tenant name: the segment after workday.com in your sign-in address. In Public Web Services, choose Web Service → View WSDL beside Human Resources. Copy the host at the bottom of the page. You’ll need the credentials, tenant name and web services host in step 5.

The agent runs as a Windows service on a domain-joined server with Windows Server 2019 or later. It connects to Workday HCM and ezOnboard over outbound HTTPS. No inbound firewall rules are needed.

Download the signed MSI and enrollment bundle from the portal. Save the install code. The portal shows it only once. Run the MSI, enter the code and choose a service account, preferably a group managed service account. The installer checks the domain connection, LDAP access, outbound access and clock before making changes.

Run the installer’s delegation script once as a domain administrator. It lets the agent’s service account create, update and disable accounts only in the OUs you choose. The agent doesn’t need Domain Admin rights.

Include the OUs for staff accounts, disabled accounts and managed groups. The agent blocks changes outside these OUs, even if a rule requests them.

In the portal, add Workday HCM as an HR source using the ISU’s user name and password, your tenant name and web services URL. Your credentials are encrypted with your organization’s key and sent to your agent. The agent reads Workday HCM from your network. Nobody at ezOnboard can read the credentials.

Choose a field to match people across both systems, usually work email or employee ID. The agent checks Workday HCM every five minutes and catches up on any missed changes.

Choose which Workday HCM fields update each directory attribute. Start with the defaults below, add custom fields or combine values. For example, build a display name from first and last names, format a job title or look up an office address by site.

Blank Workday HCM fields leave directory values unchanged unless you configure the mapping to clear them.

Rules define who gets an account, which OU it belongs in, how it’s named and which groups it joins. They also control offboarding. Use Workday HCM fields, such as department and site, to make those choices.

Our implementation team helps you write the rules. With approvals enabled, your team must approve each rule change before the agent uses it.

Run a dry run for your whole workforce. The agent matches Workday HCM records to existing accounts by employee ID, then work email, and previews changes without applying them. If two accounts match one person, that action stops for review.

Review the planned changes and the rules behind them in the portal. Adjust your rules and repeat the dry run until the results match your expectations.

Turn off dry run to apply changes. If a run would disable or move more accounts than your safety limits allow, it stops and alerts your team before making changes. We review the first runs with you.

HR continues working in Workday HCM. Your rules handle new accounts, updates and offboarding on schedule. Get alerts by email, in the portal or by webhook when a run stops, the HR feed stops updating or the agent stops reporting. An inactive feed never triggers offboarding.