Skip to main content
Documentation
Documentation
Adaptive Planning
Last Updated: 2023-06-23
Unified User Provisioning and Authentication (UPA) for Workday Adaptive Planning

Unified User Provisioning and Authentication (UPA) for Workday Adaptive Planning

Preview Date: 2025-08-16. Production Date: 2025-11-21.
For customers using Adaptive Planning with Workday single sign-on (SSO), we now deliver a unified authentication and user provisioning experience.
Watch the video:
7m 45s

Changes

To support this enhancement, Workday has introduced the following changes:
  • User Provisioning Workspace (UPW): A new workspace is available to configure and manage user provisioning for Workday Adaptive Planning.
  • User data migration: A new migration task in User Provisioning Workspace enables you to update user instance assignment information in Workday. This process automatically generates the necessary security and provisioning groups.
  • Sign-in to Workday: Enhanced authentication experience with a cleaner interface, improved security, and new password recovery options:
    • Updates to the native sign-in page.
    • Improved SMS enrollment flow.
    • New password reset option based on phone-number.
  • Sign-in to Adaptive Planning: The sign-in process for users changes from Worklet-based to a sign-in that's specific to each Adaptive Planning instance. Users can sign in either through the Workday UI or the Adaptive Planning instance-specific URL (Vanity URL).
  • API Authentication: The Adaptive Planning APIs now work with OAuth 2.0. You can authenticate to the Adaptive Planning APIs in exactly the same way you authenticate to Workday APIs.

Business Benefits

This feature provides a more streamlined and secure method for managing user access to Workday Adaptive Planning. Key benefits include:
  • Simplified administration: Centrally manage user access to Adaptive Planning instances through security groups. Enhanced User Sync:
    • Real-time user sync for user-based security groups and hourly user sync for role-based security groups.
    • Option to trigger full user sync to correct user discrepancies.
    • Support for ISU users.
  • Automatic instance assignment: Automate instance assignment through user sync configuration. You don't need to manually assign instances from the user profile or users list pages in Adaptive Planning.
  • Improved user experience: Provide an enhanced and unified sign-in experience for users accessing Adaptive Planning.

What Do I Need to Do?

A Workday administrator needs to perform a one-time configuration and migration.
To request this feature, contact your Named Support Contact to submit a Workday Customer Care request. After you configure UPA, you can't revert back to the previous configuration.
Prerequisites
  • Workday to Adaptive Planning User Sync is configured. See Steps: Set Up SAML SSO into Adaptive Planning for Synced Users..
  • Unified Access Management (UAM) is configured. SeeSteps: Set Up Unified Access Management (UAM).
  • Security:
    • These domains in the System functional area:
      • Unified Security Administration
      • Set Up: User Provisioning
      • Report: User Provisioning Status
      • Manage: Workday Adaptive Planning User Provisioning
      • The Set Up: Adaptive Planning Group Sync domain in the Adaptive Planning functional area.
      • Adaptive Planning admin permissions:
        • Admin Access > Users
        • Admin Access > Permission Sets
Configuration Steps:
  1. In Workday, configure access to User Provisioning Workspace (UPW). See Steps: Set Up User Provisioning Workspace.
    Security:
    Set Up: User Provisioning
    ,
    Report: User Provisioning Status
     and
    Manage: Workday Adaptive Planning User Provisioning
     domains in the System functional area
  2. On the Workday Home page, from the
    Global Navigation Menu
    , access the
    Manage User Provisioning for Workday Products
     worklet. Click
    User Provisioning Workspace
    .
  3. From the
    Products
    page, for each of your Adaptive Planning instances, select
    Configure
    .
  4. In the
    Configuration
    tab, click
    Migrate
    .
    This task syncs Adaptive Planning instance assignments with UPW and automatically creates security and provisioning groups based on existing Adaptive Planning configurations.
  5. Review the errors and click
    Continue
    .
  6. Click
    Preview and Approve
    :
    1. Use the
      Generate Preview Report
       to verify that all user information, security groups, and provisioning groups migrated correctly.
    2. If the data is accurate, click
      Approve
      .
  7. After completing the migration for all your Adaptive Planning instances, click
    Enable Sync for Adaptive Products
    .
  8. Select the options to confirm that your current SSO to Adaptive Planning and User Sync will be disabled and new worklets will be created for each Adaptive Planning instance. Then, click
    Confirm and Enable
    .
  9. Validate that users are synced into Adaptive Planning:
    1. In Adaptive Planning, from the main menu, select
      Administration
      .
    2. Under
      Users and Permissions
      , click the
      Users
      link.
    3. On the users list page, check the
      Last Sync Time
       column.
  10. In Workday, access the
    Enable Adaptive Planning Setup for UPC
     task and select the confirmation checkbox to switch over authentication to UPA. Click
    OK
    .
  11. Authenticate to Adaptive Planning through UPA using either of these options:
    • On the Workday Home page, from the
      Global Navigation Menu
      , click
      More
      and then click an Adaptive Planning instance. You are logged in to Adaptive Planning using single sign-on (SSO).
    • In Adaptive Planning, from the main menu, click
      Administration
      . Next under
      System
      , click
      General Setup
      . Copy and paste the
      Application URL
       into a browser tab. If you're not authenticated, you need to authenticate to Workday.
After configuring UPA, you can access Adaptive Planning APIs in the same way that you access the Workday APIs:
  1. In Workday, access the Register API Clients task to register your client in the Workday tenant. Set scope as Adaptive Planning and enter the other information. Use the generated client details to access the Adaptive Planning APIs.
    For general information about registering API clients and generating access details, see Steps: Configuring OAuth 2.0 for Your REST API Client.
  2. Call the Adaptive Planning APIs using the Workday access token:
    Example: XML-Based APIs: 
    

POST https://api.adaptiveplanning.com/api/v40
<?xml version='1.0' encoding='UTF-8'?>

<call method="exportUsers" callerName="a string that identifies your client application">

 <credentials token="<ACCESS_TOKEN>" />

</call>
  3. Example: REST APIs: 
    'Authorization': 'Bearer <ACCESS_TOKEN>'

What Happens If I Do Nothing?

If you do nothing, your existing user provisioning, single sign-on (SSO), and API integrations for Adaptive Planning will continue to function as they do today.

Change Log

Task Name Change
We have renamed the
Enable Adaptive Planning Setup for UPC
 task to
Enable Adaptive Planning Authentication with UPAS
. We have also updated the acronym from Unified User Provisioning and Authentication (UPA) to Unified Provisioning and Authentication System (UPAS).
Preview Date: 2026-07-10. Production Date: 2026-07-24.
Unified User Provisioning and Authentication
This feature is now generally available.
Preview Date: 2025-08-16. Production Date: 2025-11-21.