Set Up Assignable Roles
Security:
Set Up: Assignable Roles
domain in the Organizations and Roles functional area.Workday enables you to configure the roles that you can assign for each type of role-enabled object, providing greater security control over objects such as organizations, service centers, and spend categories.
- Access theMaintain Assignable Rolestask.
- As you complete the task, consider:
Option Description Role NameYou can enter aRole Nameto override theWorkday Rolewith a name of your choice.If you can't remove the role:- Add a phrase to theRole Name. Example:ZZZ(DO NOT USE) Buyer (for PO).
- Clear theAssigned/Reviewed by Security Groupsprompt.
Workday RoleYou can only map eachWorkday Roleselection to 1 assignable role for a specific role assigner type. Example:- The Manager role to a supervisory organization.
- The Matrix Manager role to a matrix organization.
Enabled forThis determines the organization types the assignable role can be used for. Workday recommends that you only enable a role for a single role assigner type. When you enable roles for more than 1 role assigner type, it's difficult to retrieve a worker's security access and business process routing.Organization types that also have a hierarchy type must be enabled for more than 1 role assigner type. Example: Cost Centers and Cost Center Hierarchy, Company and Company Hierarchy. To ensure that role assignees inherit the correct security access, configure an assignable role for each role assigner type that's included in the hierarchy.Default RoleWorkday uses this configuration for business process routing when the role:- Has no assignees.
- Is inherited from a superior organization.
You can only select a role for the organization types that you specified in theEnabled forprompt. You can specify aDefault Roleon theMaintain Assignable Rolestask. When a role is unfilled and has a default role configured on theMaintain Assignable Rolestask, a worker directly assigned to the default role takes precedence over a worker who inherits the role from a superior organization.When you use people-view organization charts, Workday recommends that you configure aDefault Rolethat's not linked to the Workday-owned Manager role.Workday also recommends that you don't select aDefault Rolefor the role that you link to the Workday-owned manager role on a supervisory organization.Self-AssignYou can select this check box to enable Workday to populate the role with the role maintainer's current primary position.Restricted to 'Assign Self-Assign Roles' business processSelect this check box to:- Initiate the Assign Self-Assign Roles business process when you assign a role.
- Require additional approvals when the role maintainer assigns the role
Restricted to Single AssignmentUse this check box when you want to assign multiple managers to a supervisory organization. Access theMaintain Assignable Rolestask and clear theRestricted to Single Assignmentcheck box for the Manager role.When you select this check box, you can use theSingle Assignmentcolumn when a single assignment is required for integrations and reporting fields that require a single instance. When you don't specify a single worker, Workday selects the single assignment manager alphabetically.Hide on View if Not AssignedWhen you select this check box, Workday doesn't display the role on theRolestab of an organization or on theUnassigned Roles Auditreport when it's unassigned.Is Leader / Is SupportingIs SupportingorIs Leadermust be selected for a role to view members within the organization that the role is assigned to. Workday displays roles marked asIs LeaderorIs Supportingon the worker profile.Workday displays assignees of anIs Leaderrole as leaders on organization charts and previews. The leadership role controls the role-enabled objects visible on theMy Leadership Rolesreport and worklet.When you assign a position to a supporting role, Workday displays the role on theMy Supporting Rolesreport.When you selectNone of the Abovein theIs Leader/Is Supportingprompt for a role, you must assign theWorker Data: Public Worker Reportsdomain to that role before they can view organization members.TheMy Organizationsfilter on theOrganizationsprompt on reports includes organizations for which the role assignment for the processing user is both:- Directly assigned (not an inherited role assignment).
- Assigned to a role that is configured asIs LeaderorIs Supportingin theMaintain Assignable Rolestask.
Show Inherited Assignees for Security GroupsWhen you’ve assigned a role and want to display inherited assignees on theRolestab of an organization, select a role-based security group with anAccess Rights to Organizationvalue of:- Current Organization and All Subordinates
- Current Organizations and Subordinates to Level
When you leave this field empty:- When the role is assigned, Workday only displays the assigned roles.
- When the role isn't assigned, Workday displays inherited assignees if the assignable role is linked to at least one security group with access rights of either:
- Current Organization and Unassigned Subordinates Only
- Current Organization and All Subordinates
- Current Organizations and Subordinates to Level
Role Assignees Restricted toWhen a role has any security groups in theRole Assignees Restricted tofield, only members of those security groups can be assigned to that role.If you enter a constrained role-based security group in theRole Assignees Restricted tofield, you can only assign roles to the members of the role-based constrained security group on the role-enabled objects they support.Workday recommends that you enable the restricted role and eligible security group for the same organization type, except for the Primary Recruiter and Recruiter roles.- For the Primary Recruiter and Recruiter roles, Workday recommends that you enable them for different organization types. Example: Primary Recruiter for Job Requisition organization type and Recruiter for Supervisory Organization organization type.
If you have roles in theRole Assignees Restricted Tofield and are creating a new organization, we recommend assigning roles after you have created the organization.You can't select these security group types in theRole Assignees Restricted tofield:- Segment Level
- Support Compensation Level
- Support Manager Level
- Support Service Center (Constrained)
- Support Service Center (Unconstrained)
Assigned/Reviewed by Security GroupsSpecify security groups whose members can approve assignments for this role. Members who display here are role maintainers. You can also restrict who can assign the role as a related action off a role-enabled object.When you use a constrained role-based security group, members of the Assigned By role can assign members of the role only within the organizations they support. Example: An HR Partner for a supervisory organization can assign a Manager, but only for the organizations they support.Roles that you don't assign to a security group aren't available:- As a related action on the role assigner.
- At theApprovalstep in the role assignment business process event.