Enable Single Sign-On (SSO) for Mobile

Set up Security Assertion Markup Language (SAML) authentication in the tenant.

Security: Set Up: Tenant Setup - Security
domain in the System functional area.

You can enable your users to use SAML SSO to access Workday on their mobile devices. Users access Workday on mobile devices using:

Workday mobile apps (Workday on iPad, iPhone, or Android).

Mobile browsers.

You separately configure SAML SSO access using mobile apps and browsers by setting the:

Mobile App Login Redirect URL

. If you don't set this URL, Workday uses Workday-managed authentication for mobile app access.

Mobile Browser Login Redirect URL

. If you don't set this URL, Workday uses Workday-managed authentication for mobile browser access.

Set up the mobile app and mobile browser redirect URLs in Workday.

If you use:

One SAML SSO configuration for all users in each environment, enter the redirect URLs in the

Redirection URLs

grid on the

Edit Tenant Setup - Security

task.

An authentication selector to provide more than 1 SAML SSO option to your users in each environment:

Access the

Manage Authentication Selectors

report.

Select the authentication selector and enter the redirect URLs on the task that follows.

As you complete either task, consider:

Option	Description
Mobile App Login Redirect URL	The URL to redirect users to when they sign in to Workday on iPad, iPhone, or Android: (IdP-initiated SAML) The sign-in page for your SAML provider. You obtain this URL from your SAML provider. (SP-initiated SAML) https://<workdayhost> /<tenantname> /login-saml2.htmld .
Mobile Browser Login Redirect URL	The URL to redirect users to when they sign in to Workday on a mobile browser: (IdP-initiated SAML) The sign-in page for your SAML provider. You obtain this URL from your SAML provider. (SP-initiated SAML) https://<workdayhost> /<tenantname> /login-saml2.htmld .

(Optional) Access the

Edit Tenant Setup - Security

task.

As you complete the task, consider:

Option	Description
Enable Mobile Browser SSO for Native Apps	Redirects users to a mobile browser to complete Single Sign-On (SSO) when they sign in to Workday on Android, iPad, and iPhone. After successful sign-in, Workday redirect users to the Workday app on their device. To enable hardware authentication such as YubiKey on mobile devices, you must select this option.
Enable Microsoft Edge for Login to Native Mobile Apps	Redirects users to the Microsoft Edge web browser to complete Single Sign-On (SSO) when they sign in to Workday on Android, iPad, and iPhone. After successful sign-in, Workday redirect users to the Workday app on their device.
Enable DOM Storage	Enables DOM (Document Object Model) storage for Single Sign-On (SSO) configurations that were configured to use DOM storage to work correctly. Depending on the configuration, DOM storage can optimize load times through client side storage.
Enable Certificate-Based SSO	Enables mobile devices using Workday on Android, iPad, and iPhone to use certificates instead of user name and password for SSO.
Enable Dynamic Certificate Pinning	Enables Workday mobile apps and browsers to make SSL connections only with SSO providers associated with the Trusted Domain Certificates .
Trusted Domain Certificates	One or more server certificates the mobile apps and browsers will trust. Click Create Trusted Domain Certificate and enter for each certificate: Domain Name : The domain name of the SSO provider that is providing the certificate. PEM Encoded Certificate : Include the certificate header and footer, including all of the dash (-) characters. Example: Everything including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- . You get this information from your SSO provider.

Set Up Authentication Selectors

Reference: Edit Tenant Setup - Security