Concept: Customer Central Security Model
Customer Central has a unique security model in which specific roles and permissions are set
automatically and can't be changed. This model means that a single account can’t have
multiple roles.
Customer Central has 4 security roles:
- Tenant Owner (wd-tenantowner)
- Customer Central Security Administrator
- Customer Central Administrator
- Customer Central User
- The Tenant Owner account, which Workday preconfigures, creates the first Security Administrator and Central Administrator accounts.
- The Security Administrator and Central Administrator accounts create at least 1 backup Security Administrator and 1 backup Central Administrator.
- A Central Administrator creates Central User accounts.
A Central Administrator account includes all the permissions of a User account.
You can designate a Central Administrator account as an implementer to give it access to
additional implementer-only features.
A Security Administrator account has access to an entirely separate set of features that focus
on security and are unrelated to those of Central Administrator or User.
This separation of roles means it's common for a Named Support Contact or Engagement
Manager to have both a Central Administrator Account and a Security Administrator
Account.
In addition, the Tenant Owner should designate a Virtual Clean Room (VCR) Manager. VCR
Managers control which accounts must sign into VCR before getting access to a
tenant.
VCRs are only available to deployments primed by Workday Professional Services.
Nevertheless, Workday recommends that every deployment designates at least 1 VCR Manager
before the Tenant Owner account expires.