Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-07-24
Set Up AI Administrator Security Permissions

Set Up AI Administrator Security Permissions

You might need to take additional steps to enable this feature based on your organization's subscription service agreement. Your organization is either on the Main Service Agreement (MSA) or the Universal Main Service Agreement (UMSA). To determine your organization's subscription service agreement:
  1. Select your profile avatar on Workday Community.
  2. Select
    Profile
    .
  3. On your profile page, select your organization's name, which is beneath your name and next to your job title.
  4. View your
    Subscription Service Agreement
     value.
If the value is:
UMSA is required for non-production and production tenants for Workday-Built agents. UMSA is not required for non-production tenants for self-built agents.
For information about how using agents impacts your Flex Credits, see: Workday Flex Credits Community page.
To use Sana Core and Sana Enterprise, you must:
  • Purchase the Sana Enterprise product. This only applies to Sana Enterprise.
  • Purchase the Core Human Capital Management or Core Financials product. This only applies to Sana Core.
  • Sign the UMSA.
    When you sign the agreement, Workday provides your organization with complimentary Flex Credits that you can use towards Sana Core for Workday. Once you reach the allotted complimentary Flex Credit consumption, you must sign the Workday Flex Credits and Platform Entitlement Policy to continue to use Sana Core for Workday.
  • Sign the Workday Flex Credits and Platform Entitlement Policy. This only applies to Sana Enterprise.
Security: These domains in the System functional area:
  • Security Activation
  • Security Configuration
You can bundle all the necessary security configuration steps on the
Set Up AI Admin Security Permissions
 task, which enables you to initiate back-end processing for your organization to use Workday AI features.
You can set up AI admin security permissions once for each tenant. The task enables you to grant security access for:
  • Agent System of Record: Assign users access to manage and configure AI agent behavior and integrations in a central location.
  • User Provisioning Workspace for Sana: Assign administrators to provision users to Sana.
  • Platform Consumption Console: Assign users access to monitor and manage infrastructure resources that your agents use.
  • Sana: Assign users as Sana administrators to configure Sana features in the Sana Workspace. Users with Sana administrator privileges can access and configure the Sana Workspace.
Workday sends a notification to security administrators in all your tenants to access and complete the task.
The security configuration notification expires in 30 days.
You can configure sections of the
Set Up AI Admin Security Permissions
 task separately, but Workday recommends using the task to ensure you meet all critical dependencies for your AI experience.
Security administrators must complete all sections. Once you submit the task, you can’t edit it. You can manually update the configuration through the standard Workday security settings.
When multiple administrators are configuring this task, Workday processes the first configuration submitted.
  1. Access the
    Action Required: Review and Configure the Security for Sana and Workday Agents
     notification in Workday.
    If administrators never received this notification or it expired and was removed after 30 days, you can access the
    Notify Users to Configure Sana Agent Security
     task to resend the security configuration notification. The user must have Modify permissions on the
    Security Configuration
     domain to receive the notification. The
    Notify Users to Configure Sana Agent Security
     task is only available in the tenant when you sign the UMSA. We don’t resend the notification if an administrator has already completed the
    Set Up AI Admin Security Permissions
     task.
  2. Click
    Start Configuration
    .
  3. Complete the
    Configure Security Policies
     section on the
    Configuration
     tab:
    You only need to configure grids with an
    Incomplete
     status. We display a:
    • Completed
       status when domain security policies are configured. We don't display the
      Security Group
       and
      View or Add Users to Security Group
       columns in the grid.
    • Completed with Exceptions
      status when at least 1 of the domain security policies in the
      Domain Security Policies
       column isn't currently active or has pending changes.
    Option Description
    Domain Security Policies
    Displays all the domain security policies you need configure for each workspace.
    Security Group
    Select an existing user-based security group or create a new one. Workday adds users in those groups to the domain security policies listed in the
    Domain Security Policies
     column with View and Modify permissions.
    For the Platform Consumption Console, we only require a security group with View permission on the
    Management Dashboard: Platform Consumption Console
     domain security policy. You can only add a security group to the
    Management Dashboard: Platform Consumption Console
     domain using this task if there are no existing security groups with View or View and Modify permissions configured on the domain security policy. Workday displays a
    Completed
     status on the
    Platform Consumption Console
     grid when these security configuration criteria are met.
    View or Add Users to Security Group
    Workday automatically displays the members of the security groups you selected in the
    Security Group
     column.
    You can add members only when you create a new security group or select a group that's not used in other policies and doesn't have members. You can't add or remove members when you select a security group that's currently used in other policies or has existing members.
    When a domain is disabled and you access the
    Set Up AI Admin Security Permissions
     task:
    • You can add security groups to the domain. Once you submit the changes on the task, this activates the domain.
    • We display a
      Completed
       status if the domain has existing security groups.
  4. Complete the
    Activate Pending Security Policy Changes
     tab.
    Review the security changes on the
    Configuration
     tab before activating the changes. To activate security policy changes in your tenant, you must have permission on the
    Security Activation
     domain.
    Select the
    Confirm
     check box and click
    OK
    .
  5. Click
    Done
    .
Workday automatically activates pending security policy changes and makes applicable tasks available. Workday might notify members of included security groups of additional tasks and actions they can take.
If assigning Sana administrator access to members in the security groups fails, we display a
Resubmit
 button in the
Set Up Sana Administration
 section of the
Configuration
 tab. You can retry the provisioning by clicking the button. Workday attempts to assign the users with Sana administrator privileges.
(Optional) If you need to update the configuration on this task, access the standard Workday security settings to manually make the changes.