Skip to main content
Administrator Guide
Last Updated: 2024-08-23
Set Up Assignable Roles

Set Up Assignable Roles

Security:
Set Up: Assignable Roles
domain in the Organizations and Roles functional area.
Workday enables you to configure the roles that you can assign for each type of role-enabled object, providing greater security control over objects such as organizations, service centers, and spend categories.
  1. Access the
    Maintain Assignable Roles
    task.
  2. As you complete the task, consider:
    Option Description
    Role Name
    You can enter a
    Role Name
    to override the
    Workday Role
    with a name of your choice.
    If you can't remove the role:
    • Add a phrase to the
      Role Name
      . Example:
      ZZZ(DO NOT USE) Buyer (for PO)
      .
    • Clear the
      Assigned/Reviewed by Security Groups
      prompt.
    Workday Role
    You can only map each
    Workday Role
    selection to 1 assignable role for a specific role assigner type. Example:
    • The Manager role to a supervisory organization.
    • The Matrix Manager role to a matrix organization.
    Enabled for
    This determines the organization types the assignable role can be used for. Workday recommends that you only enable a role for a single role assigner type. When you enable roles for more than 1 role assigner type, it's difficult to retrieve a worker's security access and business process routing.
    Organization types that also have a hierarchy type must be enabled for more than 1 role assigner type. Example: Cost Centers and Cost Center Hierarchy, Company and Company Hierarchy. To ensure that role assignees inherit the correct security access, configure an assignable role for each role assigner type that's included in the hierarchy.
    Default Role
    Workday uses this configuration for business process routing when the role:
    • Has no assignees.
    • Is inherited from a superior organization.
    You can only select a role for the organization types that you specified in the
    Enabled for
    prompt. You can specify a
    Default Role
    on the
    Maintain Assignable Roles
    task. When a role is unfilled and has a default role configured on the
    Maintain Assignable Roles
    task, a worker directly assigned to the default role takes precedence over a worker who inherits the role from a superior organization.
    When you use people-view organization charts, Workday recommends that you configure a
    Default Role
    that's not linked to the Workday-owned Manager role.
    Workday also recommends that you don't select a
    Default Role
    for the role that you link to the Workday-owned manager role on a supervisory organization.
    Self-Assign
    You can select this check box to enable Workday to populate the role with the role maintainer's current primary position.
    Restricted to 'Assign Self-Assign Roles' business process
    Select this check box to:
    • Initiate the Assign Self-Assign Roles business process when you assign a role.
    • Require additional approvals when the role maintainer assigns the role
    Restricted to Single Assignment
    Use this check box when you want to assign multiple managers to a supervisory organization. Access the
    Maintain Assignable Roles
    task and clear the
    Restricted to Single Assignment
    check box for the Manager role.
    When you select this check box, you can use the
    Single Assignment
    column when a single assignment is required for integrations and reporting fields that require a single instance. When you don't specify a single worker, Workday selects the single assignment manager alphabetically.
    Hide on View if Not Assigned
    When you select this check box, Workday doesn't display the role on the
    Roles
    tab of an organization or on the
    Unassigned Roles Audit
    report when it's unassigned.
    Is Leader / Is Supporting
    Is Supporting
    or
    Is Leader
    must be selected for a role to view members within the organization that the role is assigned to. Workday displays roles marked as
    Is Leader
    or
    Is Supporting
    on the worker profile.
    Workday displays assignees of an
    Is Leader
    role as leaders on organization charts and previews. The leadership role controls the role-enabled objects visible on the
    My Leadership Roles
    report and worklet.
    When you assign a position to a supporting role, Workday displays the role on the
    My Supporting Roles
    report.
    When you select
    None of the Above
    in the
    Is Leader/Is Supporting
    prompt for a role, you must assign the
    Worker Data: Public Worker Reports
    domain to that role before they can view organization members.
    The
    My Organizations
    filter on the
    Organizations
    prompt on reports includes organizations for which the role assignment for the processing user is both:
    • Directly assigned (not an inherited role assignment).
    • Assigned to a role that is configured as
      Is Leader
      or
      Is Supporting
      in the
      Maintain Assignable Roles
      task.
    Show Inherited Assignees for Security Groups
    When you’ve assigned a role and want to display inherited assignees on the
    Roles
    tab of an organization, select a role-based security group with an
    Access Rights to Organization
    value of:
    • Current Organization and All Subordinates
    • Current Organizations and Subordinates to Level
    When you leave this field empty:
    • When the role is assigned, Workday only displays the assigned roles.
    • When the role isn't assigned, Workday displays inherited assignees if the assignable role is linked to at least one security group with access rights of either:
      • Current Organization and Unassigned Subordinates Only
      • Current Organization and All Subordinates
      • Current Organizations and Subordinates to Level
    .
    Role Assignees Restricted to
    When a role has any security groups in the
    Role Assignees Restricted to
    field, only members of those security groups can be assigned to that role.
    If you enter a constrained role-based security group in the
    Role Assignees Restricted to
    field, you can only assign roles to the members of the role-based constrained security group on the role-enabled objects they support.
    Workday recommends that you enable the restricted role and eligible security group for the same organization type, except for the Primary Recruiter and Recruiter roles.
    • For the Primary Recruiter and Recruiter roles, Workday recommends that you enable them for different organization types. Example: Primary Recruiter for Job Requisition organization type and Recruiter for Supervisory Organization organization type.
    If you have roles in the
    Role Assignees Restricted To
    field and are creating a new organization, we recommend assigning roles after you have created the organization.
    You can't select these security group types in the
    Role Assignees Restricted to
    field:
    • Segment Level
    • Support Compensation Level
    • Support Manager Level
    • Support Service Center (Constrained)
    • Support Service Center (Unconstrained)
    Assigned/Reviewed by Security Groups
    Specify security groups whose members can approve assignments for this role. Members who display here are role maintainers. You can also restrict who can assign the role as a related action off a role-enabled object.
    When you use a constrained role-based security group, members of the Assigned By role can assign members of the role only within the organizations they support. Example: An HR Partner for a supervisory organization can assign a Manager, but only for the organizations they support.
    Roles that you don't assign to a security group aren't available:
    • As a related action on the role assigner.
    • At the
      Approval
      step in the role assignment business process event.