Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-08-07
Set Up Live Data Query ISU Authentication in Workday

Set Up Live Data Query ISU Authentication in Workday

  • Determine the required Integration System User (ISU) accounts you need for Live Data Query.
    Things to consider:
    • ISUs can be configured with unique table and column access controls based on their security group membership.
    • A unique ISU will likely be required for each unique configurable security combination. Example: If all downstream systems require access to all data, one ISU is sufficient. If some use cases require general information (such as secured to ‘Public Reporting’) and others require privileged information, two or more ISUs will likely be necessary.
    • For each ISU, determine the security group and which domains to grant. Use the Domain column in the Data Cloud Catalog to identify domains for the tables and fields the ISU must access. The required group type is
      Integration System Security Group (unconstrained)
      .
  • Generate the public and private key. See Generate Public and Private Keys for Workday Live Data Query.
Authenticating your Live Data Query connection with an ISU allows the external system to authenticate as a dedicated, non-person system account.
Access to data is limited by the security permissions configured for the ISU, ensuring the connection can only access the specific tables and columns it is authorized to see.
  1. Access the
    Create Integration System User
     task.
    Security:
    Integration Security
     domain in the Integration functional area.
    If an ISU has already been created for this purpose, skip this step.
    For each ISU needed for your use case, complete the task:
    Option Description
    User Name
    Enter a unique ISU user name.
    New Password
    New Password Verify
    Set a password.
    Require New Password at Next Sign In
    Don’t select the check box.
    Session Timeout Minutes
    Keep the value at zero to prevent the integration system user session from expiring.
    Do Not Allow UI Sessions
    Select the check box.
  2. Click
    OK
    .
  3. Access the
    Create Security Group
     task.
    Security:
    Security Configuration
     domain in the System functional area.
    If you're using an existing unconstrained integration system security group, skip this step.
    For each ISU needed for your use case, complete the task:
    Option Description
    Type of Tenanted Security Group
    Integration System Security Group (Unconstrained)
    Name
    Enter a unique group name based on your naming conventions.
    Integration System Users
    Add the ISU user(s).
    Click
    OK
    .
    If you make security group changes after the client connection has been established, subsequent permission changes might take up to 15 minutes to propagate before users can access newly authorized tables or columns.
  4. For each ISU security group, grant the View Only report/task permission on the required domains. Use the Domain column in the Data Cloud Catalog to identify domains for the tables and fields the ISU must access.
    To mass update security policies for a security group, run the
    Maintain Permissions for Security Group
     task. For details, see Maintain Security Group Permissions.
  5. Access the
    Activate Pending Security Policy Changes
     task.
    Security:
    Security Configuration
     domain in the System functional area.
    1. Add an appropriate comment and click
      OK
      .
    2. Review the changes, check the
      Confirm
       check box, and click
      OK
      .
    The security domain permissions and user security groups are now active.
  6. Access the
    Register API Client
     task.
    Security:
    Set Up: Tenant Setup - Security
     and
    Security Administration
     domains in the System functional area.
    Complete the task:
    Option Description
    Client Name
    Enter a unique API client name.
    Client Grant Type
    Select Jwt Bearer Grant.
    x509 Certificate
    If you have an existing x509 certificate, select it from the drop-down list.
    To create a new one, select the Create x509 Public key option from the drop-down list. Provide a name and add the public key.
    For information about the public key, see Generate Public and Private Keys for Workday Live Data Query.
    Integration System User
    Add the ISU user.
    Scope
    Select any value. This field is required but not utilized by LDQ ISU authentication.
    Include Workday Owned Scope
    Select the check box.
  7. Click
    OK
    .
    The
    Register API Client
     task displays the API Client information.
  8. Save the API Client information from the
    Register API Client
     page.
    You’ll need this information to configure Workday connector properties in the partner platform:
    Information
    Example or Details
    Token Endpoint
    https://{HOST1}/ccx/oauth2/{TENANT}/token
    Integration System User
    demo-isu
    Client ID
    MThmMWI3YWEtZDZjMS00MzRmLTliZWBeMzg4ZjI2NmI1MjFl4
Set up Live Data Query in the partner system or analytics tool of your choice. See the
External Client Setup
 section of Get Started with Workday Live Data Query.