Concept: User Activity Logging

User activity logging isn't a tenant auditing function. For information on auditing functionality in Workday, see the

Auditing

section of this Administrator Guide.

You can enable Workday to log user activity and create a logging record.

A logging record can help you better protect personal data against security threats by enabling security administrators to view user activity over a certain time period. You can also download user activity and export it to an external processing system for analysis.

You enable user activity logging in the tenant setup to log all instances of user activity in Workday.

Review your internal security and privacy (GDPR) procedures to determine how you want to use the user activity logging functionality.

The View User Activity Report

You can use the

View User Activity

report to view user activity in Workday over a selected time period. Alternatively, you can use the

User Activity

data source to create a custom report that includes specific fields you want to monitor.

For each instance of user activity, the report includes:

Field	Description
Request Time	Displays when the user activity occurred, using the time zone of the person who runs the report.
System Account	Indicates the Workday account that performed the activity. For proxy sessions, indicates the proxying Workday account and the Workday user account on whose behalf the proxy user is acting.
IP Address	Displays the IP address of the user from their sign-in.
User Agent	Displays the client browser and operating system information from the user sign-in.
Task	Displays the task or report that the account accessed. Workday also logs certain internal Workday operations. A task that's related to SSO permissions displays as blank.
Target	Displays the object that the account has taken action on.
Activity Category	Displays the type of activity performed: READ: Access to a task or report where the user viewed but didn't change data. WRITE: Access to a task where the user changed data. DOWNLOAD: Access to a report that was: Downloaded by clicking or right-clicking on the file name link in Workday. Downloaded using the Excel icon. Processed in the background. Downloaded using the View Printable Version (PDF) icon. The PDF previewer. OTHER: An activity by internal Workday operations.

When using the

View User Activity

report, consider:

Item	Considerations
Database Performance	Workday only writes to the database approximately every 2 minutes. The user activity log might not include up to the last 2 minutes of events when you view it.
Report Results	The View User Activity report only returns the first 50,000 results of a query. When run in the background, the /activityLogging REST API endpoint and the report can return up to 250,000 results.
Logging Period in Workday	Workday logs up to the last 30 days of user activity events. If the logging period exceeds 30 days, Workday removes user activity that is over 30 days old during the weekly maintenance window. We recommend that you export user activity data at least weekly. You can then monitor the throughput to ensure that you export activity you want to store locally for longer than 30 days. Example: Create a custom report to identify Workday data that a phished account possibly viewed or changed.

Concept: User Activity Logging REST API