Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-08-21
Set Up Security for Workday Everywhere Using Sana Self-Service Agent

Set Up Security for Workday Everywhere Using Sana Self-Service Agent

You might need to take additional steps to enable this feature based on your organization's subscription service agreement. Your organization is either on the Main Service Agreement (MSA) or the Universal Main Service Agreement (UMSA). To determine your organization's subscription service agreement:
  1. Select your profile avatar on Workday Community.
  2. Select
    Profile
    .
  3. On your profile page, select your organization's name, which is beneath your name and next to your job title.
  4. View your
    Subscription Service Agreement
     value.
If the value is:
  • UMSA
    , the feature is automatically available. You can skip the
    Enable Innovation Services Feature and AI Data Contributions for MSA Customers
     step. For more information on Machine Learning data contributions, see Concept: Workday AI for Universal Main Subscription Agreement Customers.
  • MSA
    , you must enable this feature through Innovation Services using the
    Enable Innovation Services Feature and AI Data Contributions for MSA Customers
    step.
Note: UMSA customers don't have Innovation Services tasks and reports in their tenants as these are for MSA customers only. UMSA customers can ignore all information regarding Innovation Services.
You can set up security to enable workers to perform some Workday self-service tasks directly in these workspaces:
  • Gemini Enterprise
  • Microsoft 365 Copilot
  • Microsoft Teams
  • Slack
  1. Complete additional setup steps required by your organization's subscription service agreement. See Sign the Universal Main Subscription Agreement (UMSA): Unlock AI Agents, Sana, Flex Credits, and Workday Innovation.
    1. Access the
      Innovation Services and Data Selection Opt-In
       task.
    2. On the
      Available Services
       tab, select the
      Workday Everywhere
       service in the
      People Experience
       category.
  2. Activate Workday Everywhere.
    1. Access the
      Maintain Functional Areas
       task.
    2. In the
      Functional Area
       column, search for
      Workday Everywhere
      .
    3. Select the
      Enabled
      check box for the Workday Everywhere functional area.
    Security: Security Configuration
     domain in the System functional area.
    1. Set up the:
      • Workday Everywhere Administrator
         domain in the Workday Everywhere functional area.
      • Security Activation subdomain of the
        Security Administration
         domain in the System functional area.
      • WQL for Workday Extend
         subdomain of the
        Workday Extend
         domain in the System functional area to enable integration with Gemini Enterprise, Microsoft 365 Copilot, Microsoft Teams, or Slack workspace.
    2. Grant the All Employees security group View and Get access to these domains in the System functional area:
      • View: Public Innovation Services Items.
      • WQL for Workday Extend
         subdomain of the
        Workday Extend
         domain.
    3. Grant the All Employees security group View and Get access to these domains in the System functional area.
      • View: Public Innovation Services Items
        .
      • WQL for Workday Extend WQL for Workday Extend
         subdomain of the
        Workday Extend domain.
    4. Grant the
      All Employees security group View and Modify
       access to the
      Workday Everywhere User
       domain in the Workday Everywhere functional area.
      This access enables workers to use Workday in their Gemini Enterprise, Microsoft 365 Copilot, Microsoft Teams, or Slack workspace. Workday recommends that you:
    5. (Optional) Grant these security groups View and Modify access to the
      Workday Everywhere User
       domain in the Workday Everywhere functional area to enable contingent workers to use Workday Everywhere:
      • All Contingent Workers.
      • Contingent Worker as Self.
      Feature availability for contingent workers depends on your tenant configurations.