Contextual Security for Onboarding Plans

Onboarding plans provide new hires with relevant information at defined stages as they transition from candidates to workers. Contextual security enables you to delegate onboarding plan administration while restricting contributors to plans relevant to their organizational responsibilities.

Workday determines contributor access from:

The Onboarding Security Category assigned to a plan

The contributor’s roles on organizations associated with the category

The contributor’s access to the applicable security domain

The security model provides central administrators with unconstrained access through the Set Up: Onboarding
domain. It provides contributors with separate constrained access options through the Set Up: Onboarding Contributor - Creator
and Set Up: Onboarding Contributor - Editor
domains.

How Contextual Security Works

An Onboarding Security Category associates an onboarding plan with one or more organizations. A contributor can access a plan when they have access to the applicable contributor domain and a role on an organization associated with the plan’s Security Category.

Onboarding Security Categories support these organization types:

Companies

Cost Centers

Custom Organizations

Supervisory Organizations

The contributor domains support role-based security groups for each of these organization types.

Contextual security restricts the plans contributors can access and the actions they can perform. It applies to all versions of a plan and its related stages and stage content.

Security Domains

Domain	Description
Set Up: Onboarding	Enables full, unconstrained access to onboarding setup in the Onboarding Planner. Users with access to this domain can configure all onboarding plans, security categories, audiences, content, notifications, branding, and related setup tasks across the tenant. Use this domain for super administrators who manage onboarding centrally.
Set Up: Onboarding Contributor - Creator	Enables constrained access to view, create, and copy onboarding plans.
Set Up: Onboarding Contributor - Editor	Enables constrained access to view and edit onboarding plans, stages, and stage content.

The contributor domains supplement the unconstrained Set Up: Onboarding
domain. Users with access to Set Up: Onboarding
retain unconstrained access to onboarding setup and plans.

Workday recommends that you review the existing security configuration for Set Up: Onboarding
and make changes as needed before configuring the contributor domains. The creator and editor domains provide different access. You can configure both domains for users who need to create, copy, and edit plans.

Plan Access by Domain

Action	Set Up: Onboarding	Set Up: Onboarding Contributor -Creator	Set Up: Onboarding Contributor - Editor
Access the Onboarding Planner	Access	Access	Access
View plans	All plans	Plans within Security Category scope	Plans within Security Category scope
Create plans	All Plans	Plans within Security Category scope	No access
Edit plans	All Plans	No access	Plans within Security Category scope
View plans as of a date	All Plans	Plans within Security Category scope	Plans within Security Category scope
View stages and stage content	All Plans	Plans within Security Category scope	Plans within Security Category scope
Create or edit stages and stage content	All Plans	During creation of Plans within Security Category scope	During edit of Plans within Security Category scope
Inactivate plans	All Plans	No access	No access
Maintain Onboarding Security Categories	Access	No access	No access

Onboarding Security Categories

A Security Category applies to all versions of an onboarding plan. The optional

Security Category

field is available on these tasks:

Copy Onboarding Plan

Create Onboarding Plan

Edit Onboarding Plan

View Onboarding Plan

View Onboarding Plan As Of

The

Security Category

field is also available on the

Plans

page in the Onboarding Planner.

Contributors can search for Security Categories by name, ID, or comment. On the

Create Onboarding Plan

and

Edit Onboarding Plan

tasks, contributors can select only categories within their organization scope.

Security Category Administration

Administrators with access to the Set Up: Onboarding
domain can use the

Maintain Onboarding Security Categories

task to create and manage Onboarding Security Categories. Each category can include:

A name

Associated organizations

A comment

Organization-specific prompts help administrators select companies, cost centers, custom organizations, and supervisory organizations.

The

View Onboarding Security Category

task displays the name, organizations, comment, and usage status of a category.

The

Security Categories

section in the Onboarding Planner displays existing categories and provides access to the

Maintain Onboarding Security Categories

task. The contributor domains don’t grant access to this section or task.

Plans Without Security Categories

Onboarding plans created before the introduction of contextual security retain their previous access behavior.

Workday displays a message alerting contributors when they submit a new or existing plan without a Security Category. If they continue, Workday saves the plan, but the contributor can no longer access it. Administrators with unconstrained access to the Set Up: Onboarding
domain retain access to the plan.

Audiences and Notifications

Contributors can:

View audience definitions.

Use the

Maintain Onboarding Plan Audiences

task to create or change audience mappings for plans within their Security Category scope.

Select existing notifications when configuring plans.

View notifications associated with a stage.

Contributors can’t maintain audience definitions or condition rules.

Access Not Provided by Contributor Domains

The Set Up: Onboarding Contributor - Creator
and Set Up: Onboarding Contributor - Editor
domains don’t grant access to these tasks:

Examine for Onboarding Issues

Maintain Onboarding Section Configurations

Maintain Onboarding Security Categories

Preview Onboarding Plan

The contributor domains also don’t grant access to:

Additional onboarding configuration

Branding functionality

Onboarding reports

Contributors might receive access to these tasks and features through other applicable security domains.

Contextual Security Scope

Contributor-domain contextual security applies to:

Onboarding plans

Onboarding plan snapshots

Onboarding stages

Onboarding stage content

Contributor access to Content Library items remains unchanged. Contributor-domain contextual security also doesn’t apply to web service access.

Web Services

In version 47.0, Workday provides these web service operations:

Web Service Operation	Description
Get Onboarding Search Categories	Retrieves Onboarding Security Categories.
Put Onboarding Search Category	Creates or changes Onboarding Security Categories, including names, organization references, and comments.
Get Onboarding Plans	Returns the Onboarding Security Category associated with an onboarding plan.
Put Onboarding Plan	Associates an Onboarding Security Category with an onboarding plan.

Steps: Inactivate Onboarding Plans

Setup Considerations: Onboarding Plans

Set Up Onboarding Planner